CVE-2021-25980 (published 2021-11-11T07:15Z)

In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-74
cwe_name: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
extended_description: Software or other automated logic has certain assumptions about what constitutes data and control respectively. It is the lack of verification of these assumptions for user-controlled input that leads to injection problems. Injection problems encompass a wide variety of issues -- all mitigated in very different ways and usually attempted in order to alter the control flow of the process. For this reason, the most effective way to discuss these weaknesses is to note the distinct features that classify them as injection weaknesses. The most important issue to note is that all injection problems share one thing in common -- i.e., they allow for the injection of control plane data into the user-controlled data plane. This means that the execution of the process may be altered by sending code in through legitimate data channels, using no other mechanism. While buffer overflows, and many other flaws, involve the use of some further issue to gain execution, injection problems need only for the data to be parsed.
         

Fix information:
repo_url: https://github.com/debiki/talkyard
commit_details: repo_url: https://github.com/debiki/talkyard
author: Kaj Magnus Lindberg
author_date: 2021-10-11 12:05:17+02:00
msg: Bump get query limit from 29 to 50. Disallow access via IP.
repository: repo_url: https://github.com/debiki/talkyard
repo_name: debiki/talkyard
description: A community discussion platform: Brings together the main features from StackOverflow, Slack, Discourse, Reddit, and Disqus blog comments.
repo_language: TypeScript
owner: debiki
file_changes: filename: Globals.scala
change_type: ModificationType.MODIFY
diff: @@ -801,11 +801,12 @@ class Globals(  // RENAME to TyApp? or AppContext? TyAppContext? variable name =
             die("DwE20SE4")
         }
       case None =>
+        /* Not really needed. Better to use a real domain name.
         if (Site.Ipv4AnyPortRegex.matches(hostname)) {
           // Make it possible to access the server before any domain has been pointed
           // to it, just after installation, by lazy-creating an empty default site.
           return defaultSiteIdAndHostname
-        }
+        } */
         throwSiteNotFound(
           hostname, debugCode = "LKPCANHOST")
     }

programming_language: Scala
filename: GetController.scala
change_type: ModificationType.MODIFY
diff: @@ -64,8 +64,8 @@ class GetController @Inject()(cc: ControllerComponents, edContext: EdContext)
 
     val authzCtx = dao.getForumAuthzContext(requester)
 
-    throwUnimplementedIf(pageRefs.size >= 30,
-          "TyE603MRT4", "Currently at most 30 at a time")
+    throwUnimplementedIf(pageRefs.size > 50,
+          "TyE603MRT4", "Currently at most 50 at a time")
 
     def notFoundMsg(embUrl: St, pageId: PageId = NoPageId): St = {
       s"No page with that embedding url or discussion id: $embUrl"

programming_language: Scala