diff --git a/gems/avo/CVE-2023-34102.yml b/gems/avo/CVE-2023-34102.yml index ce4b892760..173686597b 100644 --- a/gems/avo/CVE-2023-34102.yml +++ b/gems/avo/CVE-2023-34102.yml @@ -27,41 +27,6 @@ description: | and attempts to work with it, which may result in dangerous behavior and code execution. - ### PoC - - ![image](https://user-images.githubusercontent.com/26464774/243437854-933d94c8-4ae0-43fe-b2da-35b103e28796.png) - - In the test scenario we choose the demo app and the review - resource which has a polymorphic reviewable field. - - ![image](https://user-images.githubusercontent.com/26464774/243437954-2d947c6d-4e97-4e91-a442-405e553dd047.png) - - Intercepting the request and switching the review[reviewable_type] - from “Fish” to “File” which is a real class inside Rails - - ![image](https://user-images.githubusercontent.com/26464774/243438031-109de6d0-9370-4318-b18e-c5bcea61cf54.png) - - Corrupting the database with unusable classes will cause a crash - at the application while viewing the new record or the index - view (partial DoS) - - ![image](https://user-images.githubusercontent.com/26464774/243438104-80df5aae-86de-40fc-870d-689a03cae389.png) - - Manual delete the corrupted resource in order to recover the - applications functionality - - ![image](https://user-images.githubusercontent.com/26464774/243438182-1e7eef54-73ba-47d0-b5df-4bad14859af3.png) - - Of course it is possible to use other class names or namespaces. The - local development environment displays the backend error message - when visiting a corrupted record. Avo is trying to apply a scope to - this class that does not exist. - - ![image](https://user-images.githubusercontent.com/26464774/243438257-dbb59153-58a8-4421-b796-f2a0f2c20083.png) - - Specifying an invalid class name in the parameter will cause the - application to crash again while trying constanize the provided string - ### Impact The final exploitation of this vulnerability requires more time than diff --git a/gems/avo/CVE-2023-34103.yml b/gems/avo/CVE-2023-34103.yml index dd10820114..327ad4a904 100644 --- a/gems/avo/CVE-2023-34103.yml +++ b/gems/avo/CVE-2023-34103.yml @@ -22,13 +22,6 @@ description: | the request and modifying the post data, as the trix editor does not allow adding custom html or js tags on the frontend. - ### PoC - - ![image](https://user-images.githubusercontent.com/26464774/243434868-47857054-9b20-437f-842f-0750d53c9b0e.png) - _Adding javascript in the post request which is used when editing a "post" resource (body is declared as a trix field)_ - ![image](https://user-images.githubusercontent.com/26464774/243435009-948593a0-5179-4368-977c-ec36d2373925.png) - _Successful execution of JS code on live demo environment_ - ### Impact Unlike non-persistent XSS, persistent XSS does not require a social diff --git a/gems/avo/CVE-2024-22191.yml b/gems/avo/CVE-2024-22191.yml index 5c97278c52..7f3b54bbae 100644 --- a/gems/avo/CVE-2024-22191.yml +++ b/gems/avo/CVE-2024-22191.yml @@ -27,26 +27,6 @@ description: | the value is taken in lines **38** and **49** and seems to be interpreted directly as html in lines **44** and **55**. - ### PoC - - ![POC](https://user-images.githubusercontent.com/26570201/295596307-5d4f563e-99c0-4981-a82e-fc42cfd902c5.gif) - - To reproduce the vulnerability, follow these steps: - - 1. Edit an entry with a key_value field. - - 2. Enter the following payload into the value field: - ```POC\\\"> Outside-tag ``` - ### PoC (Proof of Concept) - - To exploit this vulnerability: - 1. Gain access to the generated Yard Doc. - 2. Locate and access the "frames.html" file. - 3. Construct a URL containing the malicious payload in the hash - segment, for instance: `#!javascript:xss` for v0.9.34, and - `#:javascript:xss` for v0.9.35 - ### Impact This XSS vulnerability presents a substantial threat by enabling diff --git a/spec/advisory_example.rb b/spec/advisory_example.rb index 6897779985..6097bbfd4a 100644 --- a/spec/advisory_example.rb +++ b/spec/advisory_example.rb @@ -140,6 +140,10 @@ expect(subject).to_not include("\\n\\n") end + it "must not have PoC sections" do + expect(subject).to_not include("### PoC") + end + it { expect(subject).to be_kind_of(String) } it { expect(subject).not_to be_empty } end