hitoshura25/cvefixes huggingface dataset:
CVE-2024-1741 (TypeScript, published 2024-04-10T17:15Z)
Description: value: lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-285 \u2014 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/auth/utils.ts
Commit message: feat: jwt invalidation (#197)



Vulnerable code:
    console.log("key", key)

    console.log({ type, projectId, orgId })
        select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
      `

Fixed code:
      const [user] =
        await sql`select * from account where id = ${ctx.state.userId}`
      if (!user) {
        ctx.throw(401, "This account no longer exists")
      }

          select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
        `
CVE-2024-1902 (TypeScript, published 2024-04-10T17:15Z)
Description: value: lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker can exploit this by using an old authorization token to send a PATCH request, modifying the organization's name even after being removed from the organization. This issue is due to incorrect synchronization and affects the orgs.patch route.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/auth/utils.ts
Commit message: feat: jwt invalidation (#197)



Vulnerable code:
    console.log("key", key)

    console.log({ type, projectId, orgId })
        select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
      `

Fixed code:
      const [user] =
        await sql`select * from account where id = ${ctx.state.userId}`
      if (!user) {
        ctx.throw(401, "This account no longer exists")
      }

          select * from account_project where account_id = ${ctx.state.userId} and project_id = ${ctx.state.projectId}
        `
CVE-2024-3504 (TypeScript, published 2024-06-06T18:15Z)
Description: value: An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/users.ts
Commit message: fix: set user to owner (#183)



Vulnerable code:

Fixed code:
    if (role === "owner") {
      ctx.throw(403, "You cannot modify the owner role")
    }
CVE-2024-3761 (TypeScript, published 2024-05-20T09:15Z)
Description: value: In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at `packages/backend/src/api/v1/datasets` is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a dataset by sending a DELETE request to the endpoint. The issue was fixed in version 1.2.8. The impact of this vulnerability is significant as it permits unauthorized users to delete datasets, potentially leading to data loss or disruption of service.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/datasets/index.ts
Commit message: fix: authorization delete dataset (#204)



Vulnerable code:
datasets.delete("/:id", async (ctx: Context) => {
  const { id } = ctx.params
  await sql`delete from dataset where id = ${id}`
  ctx.status = 200
})

Fixed code:
datasets.delete(
  "/:id",
  checkAccess("datasets", "delete"),
  async (ctx: Context) => {
    const { id } = ctx.params
    const { projectId } = ctx.state
    await sql`delete from dataset where id = ${id} and projectId = ${projectId}`
    ctx.status = 200
  },
)
CVE-2024-4146 (TypeScript, published 2024-06-08T20:15Z)
Description: value: In lunary-ai/lunary version v1.2.13, an improper authorization vulnerability exists that allows unauthorized users to access and manipulate projects within an organization they should not have access to. Specifically, the vulnerability is located in the `checkProjectAccess` method within the authorization middleware, which fails to adequately verify if a user has the correct permissions to access a specific project. Instead, it only checks if the user is part of the organization owning the project, overlooking the necessary check against the `account_project` table for explicit project access rights. This flaw enables attackers to gain complete control over all resources within a project, including the ability to create, update, read, and delete any resource, compromising the privacy and security of sensitive information.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/utils/authorization.ts
Commit message: fix: project accesss (#343)



Vulnerable code:
// TODO: Needs to use account_project instead
        from project 
        where org_id = (select org_id from account where id = ${userId}) 
          and id = ${projectId}
    `

Fixed code:
        from account_project ap
        where ap.project_id = ${projectId} and ap.account_id = ${userId}
  `
CVE-2024-5126 (TypeScript, published 2024-06-06T19:16Z)
Description: value: An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts. Affected versions include 1.2.2 up to but not including 1.2.25. The vulnerability allows unauthorized users to update prompt details due to insufficient access control checks. This issue was addressed and fixed in version 1.2.25.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/template-versions.ts
packages/backend/src/api/v1/users.ts
Commit message: fix: backend plan check (#329)



Vulnerable code:
    const { content, extra, testValues, isDraft } = ctx.request.body as {
      id: string
      content: any[]
      extra: any
      testValues: any
      isDraft: boolean
    }
    update template_version set
      content = ${sql.json(content)},
      extra = ${sql.json(unCamelObject(extra))},
      test_values = ${sql.json(testValues)},
      is_draft = ${isDraft}
    where id = ${ctx.params.id}
    returning *
  `
    ctx.body = templateVersion

Fixed code:
import { z } from "zod"
    const bodySchema = z.object({
      content: z.array(z.any()),
      extra: z.any(),
      testValues: z.any(),
      isDraft: z.boolean(),
    })

    const { content, extra, testValues, isDraft } = bodySchema.parse(
      ctx.request.body,
    )
      select
        *
      from
        template_version tv
        left join template t on tv.template_id = t.id
        left join project p on t.project_id = p.id 
      where
        tv.id = ${ctx.params.id}
        and p.org_id = ${ctx.state.orgId}
    `

    if (!templateVersion) {
      ctx.throw(401, "You don't have access to this template")
    }
    const [updatedTemplateVersion] = await sql`
      update template_version 
      set
        content = ${sql.json(content)},
        extra = ${sql.json(unCamelObject(extra))},
        test_values = ${sql.json(testValues)},
        is_draft = ${isDraft}
      where 
        id = ${ctx.params.id}
      returning *
    `

    ctx.body = updatedTemplateVersion
  if (
    role !== "member" &&
    role !== "admin" &&
    (org.plan === "free" || org.plan === "pro")
  ) {
    ctx.throw(
      401,
      "Your plan doesn't allow you to access granular access control.",
    )
  }
CVE-2024-5127 (TypeScript, published 2024-06-06T18:15Z)
Description: value: In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/template-versions.ts
packages/backend/src/api/v1/users.ts
Commit message: fix: backend plan check (#329)



Vulnerable code:
    const { content, extra, testValues, isDraft } = ctx.request.body as {
      id: string
      content: any[]
      extra: any
      testValues: any
      isDraft: boolean
    }
    update template_version set
      content = ${sql.json(content)},
      extra = ${sql.json(unCamelObject(extra))},
      test_values = ${sql.json(testValues)},
      is_draft = ${isDraft}
    where id = ${ctx.params.id}
    returning *
  `
    ctx.body = templateVersion

Fixed code:
import { z } from "zod"
    const bodySchema = z.object({
      content: z.array(z.any()),
      extra: z.any(),
      testValues: z.any(),
      isDraft: z.boolean(),
    })

    const { content, extra, testValues, isDraft } = bodySchema.parse(
      ctx.request.body,
    )
      select
        *
      from
        template_version tv
        left join template t on tv.template_id = t.id
        left join project p on t.project_id = p.id 
      where
        tv.id = ${ctx.params.id}
        and p.org_id = ${ctx.state.orgId}
    `

    if (!templateVersion) {
      ctx.throw(401, "You don't have access to this template")
    }
    const [updatedTemplateVersion] = await sql`
      update template_version 
      set
        content = ${sql.json(content)},
        extra = ${sql.json(unCamelObject(extra))},
        test_values = ${sql.json(testValues)},
        is_draft = ${isDraft}
      where 
        id = ${ctx.params.id}
      returning *
    `

    ctx.body = updatedTemplateVersion
  if (
    role !== "member" &&
    role !== "admin" &&
    (org.plan === "free" || org.plan === "pro")
  ) {
    ctx.throw(
      401,
      "Your plan doesn't allow you to access granular access control.",
    )
  }
CVE-2024-5129 (TypeScript, published 2024-06-06T19:16Z)
Description: value: A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/datasets/index.ts
Commit message: fix: authorization delete dataset (#204)



Vulnerable code:
datasets.delete("/:id", async (ctx: Context) => {
  const { id } = ctx.params
  await sql`delete from dataset where id = ${id}`
  ctx.status = 200
})

Fixed code:
datasets.delete(
  "/:id",
  checkAccess("datasets", "delete"),
  async (ctx: Context) => {
    const { id } = ctx.params
    const { projectId } = ctx.state
    await sql`delete from dataset where id = ${id} and projectId = ${projectId}`
    ctx.status = 200
  },
)
CVE-2024-5130 (TypeScript, published 2024-06-06T19:16Z)
Description: value: An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/datasets/index.ts
Commit message: fix: authorization delete dataset (#204)



Vulnerable code:
datasets.delete("/:id", async (ctx: Context) => {
  const { id } = ctx.params
  await sql`delete from dataset where id = ${id}`
  ctx.status = 200
})

Fixed code:
datasets.delete(
  "/:id",
  checkAccess("datasets", "delete"),
  async (ctx: Context) => {
    const { id } = ctx.params
    const { projectId } = ctx.state
    await sql`delete from dataset where id = ${id} and projectId = ${projectId}`
    ctx.status = 200
  },
)
CVE-2024-5131 (TypeScript, published 2024-06-06T19:16Z)
Description: value: An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the ownership of the prompt ID. This issue was fixed in version 1.2.25.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-284 \u2014 Improper Access Control
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Repository: https://github.com/lunary-ai/lunary
Files changed:
packages/backend/src/api/v1/template-versions.ts
Commit message: fix: api security (#331)



Vulnerable code:
    select * from template_version where id = ${ctx.params.id}
    select * from template where project_id = ${ctx.state.projectId} and id = ${version.templateId}

Fixed code:
  const { id: versionId } = ctx.params
  const { projectId } = ctx.state

    select
      tv.*
    from
      template_version tv
      left join template t on tv.template_id = t.id
      left join project p on t.project_id = p.id and p.id = ${projectId}
    where
      tv.id = ${versionId}
  if (!version) {
    ctx.throw(401, "You do not have access to this ressource.")
  }
    select * from template where project_id = ${projectId} and id = ${version.templateId}
CVE-2021-27693 (Java, published 2022-09-02T18:15Z)
Description: value: Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/sanluan/PublicCMS
Files changed:
publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/UeditorAdminController.java
Commit message: https://github.com/sanluan/PublicCMS/issues/51

Vulnerable code:
                        if (CommonUtils.notEmpty(suffix)) {
                Map<String, Object> map = getResultMap(true);
                map.put("list", list);
                return map;

Fixed code:
                        if (null != fileType.getMimeType() && fileType.getMimeType().startsWith("image/")
                                && CommonUtils.notEmpty(suffix)) {
                if (list.isEmpty()) {
                    return getResultMap(false);
                } else {
                    Map<String, Object> map = getResultMap(true);
                    map.put("list", list);
                    return map;
                }
CVE-2022-29784 (Java, published 2022-06-03T21:15Z)
Description: value: PublicCMS V4.0.202204.a and below contains an information leak via the component /views/directive/sys/SysConfigDataDirective.java.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/sanluan/PublicCMS
Files changed:
publiccms-parent/build.gradle
publiccms-parent/pom.xml
publiccms-parent/publiccms-core/src/main/java/com/publiccms/common/constants/CmsVersion.java
publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysConfigDataDirective.java
publiccms-parent/publiccms-core/src/main/java/com/publiccms/views/directive/sys/SysDatasourceDirective.java
Commit message: 安全漏洞修复 感谢 姜洋-长亭科技

Vulnerable code:
    version = 'V4.0.202204.a'
        <version.publiccms>V4.0.202204.a</version.publiccms>
        return "a";

Fixed code:
    version = 'V4.0.202204.b'
        <version.publiccms>V4.0.202204.b</version.publiccms>
        return "b";
    @Override
    public boolean needAppToken() {
        return true;
    }

    @Override
    public boolean needAppToken() {
        return true;
    }
CVE-2022-3950 (JavaScript, published 2022-11-11T14:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component Tab Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a972dc9b1c94aea2d84478bf26283904c21e4ca2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213456.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/sanluan/PublicCMS
Files changed:
publiccms-parent/publiccms/src/main/webapp/resource/js/dwz.min.js
Commit message: 标签页xss修复

Vulnerable code:
            var title = $this.attr("title") || $this.text();
            var titleHtml = $this.attr("title") || $this.html();
            var icon = $this.attr("icon");
            if(icon){
                titleHtml = icon + " " + titleHtml;
            }
                title: title, titleHtml: titleHtml, fresh: fresh, external: external, focusNewWindow:newWindow
            var title = $this.attr("title") || $this.html();
            title: "New Tab", titleHtml: "New Tab", data: {}, fresh: true, external: false, focusNewWindow:false
            this._getTabs().eq(this._currentIndex).after($('<li tabid="' + tabid + '"><a href="javascript:;" class="close"><i class="icon-remove-sign"></i></a></li>').attr('tabid',tabid).append($('<a href="javascript:"></a>').attr('title',op.title).html(op.titleHtml)));
            this._getMoreLi().eq(this._currentIndex).after($('<li></li>').append($('<a href="javascript:"></a>').attr('title',op.title).html(op.titleHtml)));
                    dialog.find(".dialogHeader").find("h1").html(title);
                dialog.find(".dialogHeader").find("h1").html(title);

Fixed code:
             var title = $this.attr("title") || $this.text();
            var icon = $this.attr("icon") || $this.find("i").prop("outerHTML");
                title: title, icon: icon, fresh: fresh, external: external, focusNewWindow:newWindow
            var title = $this.attr("title") || $this.text();
            title: "New Tab", icon: "", data: {}, fresh: true, external: false, focusNewWindow:false
            this._getTabs().eq(this._currentIndex).after($('<li><a href="javascript:;" class="close"><i class="icon-remove-sign"></i></a></li>').attr('tabid',tabid).prepend($('<a href="javascript:"></a>').attr('title',op.title).text(op.title).prepend(op.icon)));
            this._getMoreLi().eq(this._currentIndex).after($('<li></li>').append($('<a href="javascript:"></a>').attr('title',op.title).text(op.title).prepend(op.icon)));
                    dialog.find(".dialogHeader").find("h1").text(title);
                dialog.find(".dialogHeader").find("h1").text(title);
CVE-2023-25807 (Unknown, published 2023-02-28T16:15Z)
Description: value: DataEase is an open source data visualization and analysis tool. When saving a dashboard on the DataEase platform saved data can be modified and store malicious code. This vulnerability can lead to the execution of malicious code stored by the attacker on the server side when the user accesses the dashboard. The vulnerability has been fixed in version 1.18.3.

Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/dataease/dataease
Files changed:
Commit message: Merge pull request #4596 from dataease/pr@dev@refactor_xss-attack

refactor: 仪表板防范XSS攻击 #4585

Vulnerable code:

Fixed code: