CVE-2024-36115 (published 2024-06-19T18:15Z)

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML content with javascript inside, the javascript is executed within the same origin. Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the browser's local storage where the user's password (aka 'token-secret') is stored. It is especially dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such malicious packages can be used to attack the Reposilite instance. This issue may lead to the full Reposilite instance compromise. If this attack is performed against the admin user, it's possible to use the admin API to modify settings and artifacts on the instance. In the worst case scenario, an attacker would be able to obtain the Remote code execution on all systems that use artifacts from Reposilite. It's important to note that the attacker does not need to lure a victim user to use a malicious artifact, but just open a link in the browser. This link can be silently loaded among the other HTML content, making this attack unnoticeable. Even if the Reposilite instance is located in an isolated environment, such as behind a VPN or in the local network, this attack is still possible as it can be performed from the admin browser. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-072.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/dzikoysk/reposilite
commit_details: repo_url: https://github.com/dzikoysk/reposilite
author: dzikoysk
author_date: 2024-05-03 13:23:48+02:00
msg: GHSA-9w8w-34vr-65j2 Serve repository content in sandbox to improve security on human-readable resources
repository: repo_url: https://github.com/dzikoysk/reposilite
repo_name: dzikoysk/reposilite
description: Lightweight and easy-to-use repository management software dedicated for the Maven based artifacts in the JVM ecosystem 📦
repo_language: Kotlin
owner: dzikoysk
file_changes: filename: JavalinExtensions.kt
change_type: ModificationType.MODIFY
diff: @@ -25,15 +25,16 @@ import io.javalin.http.Context
 import io.javalin.http.HandlerType.HEAD
 import io.javalin.http.HandlerType.OPTIONS
 import io.javalin.http.Header.CACHE_CONTROL
+import io.javalin.http.Header.CONTENT_SECURITY_POLICY
 import io.javalin.http.HttpStatus
-import org.eclipse.jetty.server.HttpOutput
-import panda.std.Result
 import java.io.Closeable
 import java.io.InputStream
 import java.io.OutputStream
 import java.net.URLEncoder
 import java.nio.charset.Charset
 import kotlin.time.Duration.Companion.hours
+import org.eclipse.jetty.server.HttpOutput
+import panda.std.Result
 
 internal class ContentTypeSerializer : StdSerializer<ContentType> {
 
@@ -93,6 +94,8 @@ internal fun Context.resultAttachment(
     cache: Boolean,
     data: InputStream
 ) {
+    header(CONTENT_SECURITY_POLICY, "sandbox")
+
     if (!contentType.isHumanReadable) {
         contentDisposition("""attachment; filename="$name"; filename*=utf-8''${URLEncoder.encode(name, "utf-8")}""")
     }

programming_language: Scala
repo_url: https://github.com/dzikoysk/reposilite
commit_details: repo_url: https://github.com/dzikoysk/reposilite
author: dzikoysk
author_date: 2024-05-03 20:26:12+02:00
msg: GHSA-9w8w-34vr-65j2 Open raw javadoc resources in sandbox
repository: repo_url: https://github.com/dzikoysk/reposilite
repo_name: dzikoysk/reposilite
description: Lightweight and easy-to-use repository management software dedicated for the Maven based artifacts in the JVM ecosystem 📦
repo_language: Kotlin
owner: dzikoysk
file_changes: filename: JavadocEndpoints.kt
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,7 @@ import com.reposilite.shared.extensions.encoding
 import com.reposilite.storage.api.toLocation
 import com.reposilite.web.api.ReposiliteRoute
 import io.javalin.community.routing.Route.GET
+import io.javalin.http.Header
 
 internal class JavadocEndpoints(javadoc: JavadocFacade) : MavenRoutes(javadoc.mavenFacade) {
 
@@ -51,7 +52,7 @@ internal class JavadocEndpoints(javadoc: JavadocFacade) : MavenRoutes(javadoc.ma
                 requireRepository { repository ->
                     response = JavadocRawRequest(this?.identifier, repository, gav, requireParameter("resource").toLocation())
                         .let { javadoc.findRawJavadocResource(it) }
-                        .peek { ctx.encoding(Charsets.UTF_8).contentType(it.contentType) }
+                        .peek { ctx.encoding(Charsets.UTF_8).contentType(it.contentType).header(Header.CONTENT_SECURITY_POLICY, "sandbox") }
                         .map { it.content }
                 }
             }

programming_language: Scala