Skip to content

Commit 6d144c2

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3m9m-24vh-39wx GHSA-95wr-3f2v-v2wh GHSA-j8j5-7r4h-vj2g
1 parent 439ad36 commit 6d144c2

File tree

3 files changed

+196
-7
lines changed

3 files changed

+196
-7
lines changed

‎advisories/github-reviewed/2026/04/GHSA-3m9m-24vh-39wx/GHSA-3m9m-24vh-39wx.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3m9m-24vh-39wx",
4+
"modified": "2026-04-14T23:35:16Z",
5+
"published": "2026-04-14T23:35:16Z",
6+
"aliases": [],
7+
"summary": "Server-Side Request Forgery (SSRF) in Craft CMS with Asset Uploads Mutations",
8+
"details": "## Required Permissions\n\nThe exploitation requires a few permissions to be enabled in the used GraphQL schema:\n\n* \"Edit assets in the <VolumeName> volume\"\n* \"Create assets in the <VolumeName> volume\"\n\n## Details\n\nThe implementation fails to restrict the URL Scheme. While the application is intended to \"upload assets\", there is no whitelist forcing `http` or `https`. This allows attackers to use the Gopher protocol to wrap raw TCP commands.\n\n**Impact:** Combined with the DWORD bypass, an attacker can hit internal services without triggering any \"127.0.0.1\" string-matching filters.\n\n**Example Payload:** gopher://2130706433:6379/_FLUSHALL (Targets local Redis via DWORD).\n\n**Remediation Strategy**\n\nTo prevent mathematical IP obfuscation, the application must normalize the hostname before validation.",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "craftcms/cms"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "5.0.0-RC1"
27+
},
28+
{
29+
"fixed": "5.9.15"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 5.9.14"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "Packagist",
41+
"name": "craftcms/cms"
42+
},
43+
"ranges": [
44+
{
45+
"type": "ECOSYSTEM",
46+
"events": [
47+
{
48+
"introduced": "4.0.0-RC1"
49+
},
50+
{
51+
"fixed": "4.17.9"
52+
}
53+
]
54+
}
55+
],
56+
"database_specific": {
57+
"last_known_affected_version_range": "<= 4.17.8"
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-3m9m-24vh-39wx"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/craftcms/cms/commit/d20aecfaa0eae076c4154be3b17e1f9fa05ce46f"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/craftcms/cms"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-918"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-04-14T23:35:16Z",
82+
"nvd_published_at": null
83+
}
84+
}

‎advisories/github-reviewed/2026/04/GHSA-95wr-3f2v-v2wh/GHSA-95wr-3f2v-v2wh.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-95wr-3f2v-v2wh",
4+
"modified": "2026-04-14T23:36:10Z",
5+
"published": "2026-04-14T23:36:09Z",
6+
"aliases": [],
7+
"summary": "Craft CMS has a host header injection leading to SSRF via resource-js endpoint",
8+
"details": "### Summary\n\nThe `resource-js` endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. \nWhen `trustedHosts` is not explicitly restricted (default configuration), the application trusts the client-supplied Host header. \n\nThis allows an attacker to control the derived `baseUrl`, which is used in prefix validation inside `actionResourceJs()`. \nBy supplying a malicious Host header, the attacker can make the server issue arbitrary HTTP requests, leading to Server-Side Request Forgery (SSRF).\n\n### Details\n\nThe vulnerability exists in `AppController::actionResourceJs()`.\n\nThe function validates that the `url` parameter starts with `assetManager->baseUrl`. However, `baseUrl` is derived from the current request host. If `trustedHosts` is not configured, the Host header is fully attacker-controlled.\n\nAttack chain:\n\n1. Attacker sends request with controlled `Host` header.\n2. Application derives `baseUrl` from the malicious Host.\n3. `url` parameter is required to start with this `baseUrl`.\n4. Validation passes.\n5. Guzzle performs a server-side HTTP request to the attacker-controlled host.\n6. SSRF occurs.\n\nThis does not rely on string parsing bypass. It relies on Host header trust.\n\n### PoC (safe reproduction steps)\n\nEnvironment:\n- Craft CMS 5.9.12\n- Default configuration (no trustedHosts restriction)\n- Docker deployment\n\n1. Start a listener inside the container:\n python3 -m http.server 9999\n\n2. Send a request to resource-js with a controlled Host header.\n\n3. Observe that the internal listener receives a request (OOB confirmation).",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "Packagist",
19+
"name": "craftcms/cms"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "5.0.0-RC1"
27+
},
28+
{
29+
"fixed": "5.9.15"
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"last_known_affected_version_range": "<= 5.9.14"
36+
}
37+
},
38+
{
39+
"package": {
40+
"ecosystem": "Packagist",
41+
"name": "craftcms/cms"
42+
},
43+
"ranges": [
44+
{
45+
"type": "ECOSYSTEM",
46+
"events": [
47+
{
48+
"introduced": "4.0.0-RC1"
49+
},
50+
{
51+
"fixed": "4.17.9"
52+
}
53+
]
54+
}
55+
],
56+
"database_specific": {
57+
"last_known_affected_version_range": "<= 4.17.8"
58+
}
59+
}
60+
],
61+
"references": [
62+
{
63+
"type": "WEB",
64+
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-95wr-3f2v-v2wh"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/craftcms/cms/commit/ebe7e85f1c89700d64332f72492be2e9a594e783"
69+
},
70+
{
71+
"type": "PACKAGE",
72+
"url": "https://github.com/craftcms/cms"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-918"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-04-14T23:36:09Z",
82+
"nvd_published_at": null
83+
}
84+
}

advisories/unreviewed/2026/04/GHSA-j8j5-7r4h-vj2g/GHSA-j8j5-7r4h-vj2g.json renamed to advisories/github-reviewed/2026/04/GHSA-j8j5-7r4h-vj2g/GHSA-j8j5-7r4h-vj2g.json

Lines changed: 28 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,12 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-j8j5-7r4h-vj2g",
4-
"modified": "2026-04-13T21:30:45Z",
4+
"modified": "2026-04-14T23:37:05Z",
55
"published": "2026-04-13T21:30:45Z",
66
"aliases": [
77
"CVE-2026-6216"
88
],
9+
"summary": "DbGate has cross site scripting via the SVG Icon String Handler component",
910
"details": "A security vulnerability has been detected in DbGate up to 7.1.4. This affects an unknown function of the file packages/web/src/icons/FontIcon.svelte of the component SVG Icon String Handler. Such manipulation of the argument applicationIcon leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 7.1.5 mitigates this issue. It is advisable to upgrade the affected component.",
1011
"severity": [
1112
{
@@ -14,17 +15,37 @@
1415
},
1516
{
1617
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
19+
}
20+
],
21+
"affected": [
22+
{
23+
"package": {
24+
"ecosystem": "npm",
25+
"name": "dbgate-web"
26+
},
27+
"ranges": [
28+
{
29+
"type": "ECOSYSTEM",
30+
"events": [
31+
{
32+
"introduced": "0"
33+
},
34+
{
35+
"fixed": "7.1.5"
36+
}
37+
]
38+
}
39+
]
1840
}
1941
],
20-
"affected": [],
2142
"references": [
2243
{
2344
"type": "ADVISORY",
2445
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6216"
2546
},
2647
{
27-
"type": "WEB",
48+
"type": "PACKAGE",
2849
"url": "https://github.com/dbgate/dbgate"
2950
},
3051
{
@@ -48,9 +69,9 @@
4869
"cwe_ids": [
4970
"CWE-79"
5071
],
51-
"severity": "MODERATE",
52-
"github_reviewed": false,
53-
"github_reviewed_at": null,
72+
"severity": "LOW",
73+
"github_reviewed": true,
74+
"github_reviewed_at": "2026-04-14T23:37:05Z",
5475
"nvd_published_at": "2026-04-13T21:16:32Z"
5576
}
5677
}

0 commit comments

Comments
 (0)