GHSA-wxf3-4fvj-vqqx

Suggest an improvement
Source
https://github.com/advisories/GHSA-wxf3-4fvj-vqqx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-wxf3-4fvj-vqqx/GHSA-wxf3-4fvj-vqqx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-wxf3-4fvj-vqqx
Published
2023-07-27T19:28:02Z
Modified
2026-02-03T03:12:28Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H CVSS Calculator
Summary
Unsafe plugins can be installed via pack import by tenant admins
Details

Summary

Unsafe plugins (for instance sql-list) can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables

Details

I have an example https://bot20230704.saltcorn.com/view/all_plugins It's publicly accessible (but has not so secure values except list of tenants). But using this mech one can read any data from other tenants.

Impact

All tenants of installation (i.e. saltcorn.com), can be compromised from tenant user has admin access. If an untrusted user has admin rights to a tenant instance, they will be able to install a plug-in that can access information from other tenants

Revived after 0.8.7

After patch in 0.8.7 this is not fixed completely.

Here are steps to reproduce:

  1. Publish to NPM plugin that was not approved by admin (in case of saltcorn.com) by @glutamate. I've just published this one: https://www.npmjs.com/package/saltcorn-qrcode
  2. Publish somewhere plugin store that includes plugin from previous step: https://gist.github.com/pyhedgehog/f1fd7cb13f4d0a7ccf6a965748d19bd2
  3. Add plugin store link to tenant store.
  4. Install plugin.
  5. Use it in tenant: https://bot20230704.saltcorn.com/view/testqr_show/1

Here are logic: Unsafe plugins checked against this list: https://github.com/saltcorn/saltcorn/blob/99fe277e497fd193bb070acd8c663aa254a9907c/packages/server/load_plugins.js#L191 But it's under control of tenant admin, not server admin. Proposed login:

const safes = getRootState().getConfig("available_plugins",[]).filter(p=>!p.unsafe).map(p=>p.location);
Database specific 
{
    "cwe_ids":  [],
    "github_reviewed":  true,
    "github_reviewed_at":  "2023-07-27T19:28:02Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

npm / @saltcorn/cli

Package

Name
@saltcorn/cli
View open source insights on deps.dev
Purl
pkg:npm/%40saltcorn/cli

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.8-beta.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-wxf3-4fvj-vqqx/GHSA-wxf3-4fvj-vqqx.json"