High, CVSS 8.7npmAmendedPublished
Unsafe plugins can be installed via pack import by tenant admins
GHSA-wxf3-4fvj-vqqx
- Affected
- npm @saltcorn/cli < 0.8.8-beta.2
- Fixed in
- 0.8.8-beta.2· Vendor fix available
- Issue
- Unsafe plugins (for instance sql-list) can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables Details I have an example https://bot20230704.saltcorn.com/view/allplugins It's publicly accessible (but has not so secure values except list of tenants). But using this mech one can read any data from other tenants. Impact All tenants of installation (i.e. saltcorn.com), can be compromised from tenant user has admin access. If an untrusted user has admin rights to a tenant instance, they will be able to install a plug-in that can access information from other tenants Revived after 0.8.7 After patch in 0.8.7 this is not fixed completely. Here are steps to reproduce: 1. Publish to NPM plugin that was not approved by admin (in case of saltcorn.com) by @glutamate. I've just published this one: https://www.npmjs.com/package/saltcorn-qrcode 2. Publish somewhere plugin store that includes plugin from previous step:…
Recommended action: Upgrade to 0.8.8-beta.2 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.