Skip to content

Commit 920351a

Browse files
CosasDePumaCosasDePuma
committed
🩹 Patches
1 parent 74963ae commit 920351a

6 files changed

Lines changed: 142 additions & 23 deletions

File tree

‎CVE-2023-45908/README.md‎

Lines changed: 35 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
# 🙅🏻 CVE-2023-45908
22

33
[![Product](https://img.shields.io/badge/product-homarr%20%3C0.14.0-green?style=for-the-badge&logo=GitHub)](https://github.com/ajnart/homarr)
4-
[![CWE](https://img.shields.io/badge/CWE-80-%23f0f0f0?style=for-the-badge&logo=OWASP)](https://cwe.mitre.org/data/definitions/80.html)
5-
6-
4+
[![CWE](https://img.shields.io/badge/WSTG-INPV᠆02-%23777?style=for-the-badge&logo=OWASP&labelColor=%2398afc7)](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting)
5+
[![CWE](https://img.shields.io/badge/CWE-83-%23777?style=for-the-badge&logo=OWASP&labelColor=%2332498D)](https://cwe.mitre.org/data/definitions/83.html)
6+
[![CAPEC](https://img.shields.io/badge/CAPEC-244-%23777?style=for-the-badge&logo=OWASP&labelColor=%23800000)](https://capec.mitre.org/data/definitions/244.html)
77

88
## 📋 Description
99

@@ -13,18 +13,43 @@
1313

1414
The vulnerability was fixed in [Pull Request #1459](https://github.com/ajnart/homarr/pull/1459). The security flaw was derived from the npm [tiptap](https://www.npmjs.com/package/tiptap) package.
1515

16-
![PR #1459](patch.png)
17-
18-
## ⚛️ Nuclei Template
16+
```diff
17+
@@ -33,7 +33,14 @@ export function Editor({ widget }: { widget: INotebookWidget }) {
18+
const [debouncedContent] = useDebouncedValue(content, 500);
19+
20+
const editor = useEditor({
21+
- extensions: [StarterKit, Link],
22+
+ extensions: [
23+
+ StarterKit,
24+
+ Link.configure({
25+
+ validate(url) {
26+
+ return /^https?:\/\//.test(url);
27+
+ },
28+
+ }),
29+
+ ],
30+
content,
31+
editable: false,
32+
onUpdate: (e) => {
33+
```
1934

20-
```ocaml
21-
-- NOT AVAILABLE --
35+
## 🐳 Vulnerable Lab
36+
37+
```yaml
38+
---
39+
services:
40+
cve-2023-45908:
41+
container_name: "homarr"
42+
image: "ghcr.io/cosasdepuma/cve-research:cve-2023-45908"
43+
restart: "unless-stopped"
44+
ports: ["80:7575"]
45+
...
2246
```
2347

2448
## 🔗 References
2549

2650
* **CVE Record**: https://www.cve.org/CVERecord?id=CVE-2023-45908
2751
* **Vendor URL**: https://homarr.dev/
28-
* **Fixed Release**: https://github.com/ajnart/homarr/discussions/1574
2952
* **Pull Request**: https://github.com/ajnart/homarr/pull/1459
30-
* **CWE**: https://cwe.mitre.org/data/definitions/80.html
53+
* **CWE**: https://cwe.mitre.org/data/definitions/83.html
54+
* **CAPEC**: https://capec.mitre.org/data/definitions/244.html
55+
* **WSTG**: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting

‎CVE-2023-45908/patch.diff‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
From 38394f2dbdc7313e8b6f973b4bb44e375a3aee5f Mon Sep 17 00:00:00 2001
2+
From: Manuel <30572287+manuel-rw@users.noreply.github.com>
3+
Date: Mon, 9 Oct 2023 21:12:33 +0200
4+
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20Fix=20tiptap=20url=20CV?=
5+
=?UTF-8?q?E?=
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
Source: https://github.com/ajnart/homarr/pull/1459
11+
12+
---
13+
src/widgets/notebook/NotebookEditor.tsx | 13 ++++++++++---
14+
1 file changed, 10 insertions(+), 3 deletions(-)
15+
16+
diff --git a/src/widgets/notebook/NotebookEditor.tsx b/src/widgets/notebook/NotebookEditor.tsx
17+
index ce71e9f13d9..4ec8ccb6970 100644
18+
--- a/src/widgets/notebook/NotebookEditor.tsx
19+
+++ b/src/widgets/notebook/NotebookEditor.tsx
20+
@@ -5,12 +5,12 @@ import { IconEdit, IconEditOff } from '@tabler/icons-react';
21+
import { BubbleMenu, useEditor } from '@tiptap/react';
22+
import StarterKit from '@tiptap/starter-kit';
23+
import { useState } from 'react';
24+
+import { useEditModeStore } from '~/components/Dashboard/Views/useEditModeStore';
25+
+import { useConfigContext } from '~/config/provider';
26+
import { useConfigStore } from '~/config/store';
27+
import { useColorTheme } from '~/tools/color';
28+
import { api } from '~/utils/api';
29+
30+
-import { useEditModeStore } from '~/components/Dashboard/Views/useEditModeStore';
31+
-import { useConfigContext } from '~/config/provider';
32+
import { WidgetLoading } from '../loading';
33+
import { INotebookWidget } from './NotebookWidgetTile';
34+
35+
@@ -33,7 +33,14 @@ export function Editor({ widget }: { widget: INotebookWidget }) {
36+
const [debouncedContent] = useDebouncedValue(content, 500);
37+
38+
const editor = useEditor({
39+
- extensions: [StarterKit, Link],
40+
+ extensions: [
41+
+ StarterKit,
42+
+ Link.configure({
43+
+ validate(url) {
44+
+ return /^https?:\/\//.test(url);
45+
+ },
46+
+ }),
47+
+ ],
48+
content,
49+
editable: false,
50+
onUpdate: (e) => {

‎CVE-2023-45908/patch.png‎

-416 KB
Binary file not shown.

‎CVE-2025-25904/README.md‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,24 @@
55
[![CWE](https://img.shields.io/badge/CWE-83-%23777?style=for-the-badge&logo=OWASP&labelColor=%2332498D)](https://cwe.mitre.org/data/definitions/83.html)
66
[![CAPEC](https://img.shields.io/badge/CAPEC-244-%23777?style=for-the-badge&logo=OWASP&labelColor=%23800000)](https://capec.mitre.org/data/definitions/244.html)
77

8-
98
## 📋 Description
109

1110
**[Homarr](https://github.com/ajnart/homarr/) after v0.11.4 and before v0.15.8** was discovered to contain a **Stored Cross-Site Scripting (XSS)** vulnerability via the **iFrame widget** that can be exploited using maliciously crafted hyperlinks.
1211

13-
1412
## 🩹 Patch
1513

1614
The vulnerability was fixed in [Pull Request #2215](https://github.com/ajnart/homarr/pull/2215). More vulnerabilities were fixed in the same PR.
1715

18-
![PR #2215](patch.png)
19-
16+
```diff
17+
@@ -116,6 +116,7 @@ function IFrameTile({ widget }: IFrameTileProps) {
18+
return (
19+
<Container h="100%" w="100%" maw="initial" mah="initial" p={0}>
20+
<iframe
21+
+ sandbox="" // Disables js execution see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox
22+
className={classes.iframe}
23+
src={widget.properties.embedUrl}
24+
title="widget iframe"
25+
```
2026

2127
## 🐳 Vulnerable Lab
2228

@@ -25,20 +31,12 @@ The vulnerability was fixed in [Pull Request #2215](https://github.com/ajnart/ho
2531
services:
2632
cve-2025-25904:
2733
container_name: "homarr"
28-
image: "ghcr.io/ajnart/homarr:0.15.7"
34+
image: "ghcr.io/cosasdepuma/cve-research:cve-2025-25904"
2935
restart: "unless-stopped"
3036
ports: ["80:7575"]
3137
...
3238
```
3339

34-
35-
## ⚛️ Nuclei Template
36-
37-
```ocaml
38-
-- NOT AVAILABLE --
39-
```
40-
41-
4240
## 🔗 References
4341

4442
* **CVE Record**: https://www.cve.org/CVERecord?id=CVE-2025-25904

‎CVE-2025-25904/patch.diff‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
From c4bf3c7685787a235dbb0b20bb7e16f871149326 Mon Sep 17 00:00:00 2001
2+
From: Meier Lukas <meierschlumpf@gmail.com>
3+
Date: Sat, 7 Dec 2024 09:57:44 +0100
4+
Subject: [PATCH 1/2] fix: xss through iframes with sandbox attribute
5+
6+
Source: https://github.com/ajnart/homarr/pull/2215
7+
8+
---
9+
src/widgets/iframe/IFrameTile.tsx | 1 +
10+
1 file changed, 1 insertion(+)
11+
12+
diff --git a/src/widgets/iframe/IFrameTile.tsx b/src/widgets/iframe/IFrameTile.tsx
13+
index 86b32c89c1b..a66bb4666c4 100644
14+
--- a/src/widgets/iframe/IFrameTile.tsx
15+
+++ b/src/widgets/iframe/IFrameTile.tsx
16+
@@ -116,6 +116,7 @@ function IFrameTile({ widget }: IFrameTileProps) {
17+
return (
18+
<Container h="100%" w="100%" maw="initial" mah="initial" p={0}>
19+
<iframe
20+
+ sandbox="" // Disables js execution see TODO: add link
21+
className={classes.iframe}
22+
src={widget.properties.embedUrl}
23+
title="widget iframe"
24+
25+
From 1aeafb513ab8e53d0ef30cb4a2985f11ff68dff6 Mon Sep 17 00:00:00 2001
26+
From: Meier Lukas <meierschlumpf@gmail.com>
27+
Date: Sat, 7 Dec 2024 22:19:13 +0100
28+
Subject: [PATCH 2/2] chore: add link to docs
29+
30+
---
31+
src/widgets/iframe/IFrameTile.tsx | 2 +-
32+
1 file changed, 1 insertion(+), 1 deletion(-)
33+
34+
diff --git a/src/widgets/iframe/IFrameTile.tsx b/src/widgets/iframe/IFrameTile.tsx
35+
index a66bb4666c4..ab3f1790d71 100644
36+
--- a/src/widgets/iframe/IFrameTile.tsx
37+
+++ b/src/widgets/iframe/IFrameTile.tsx
38+
@@ -116,7 +116,7 @@ function IFrameTile({ widget }: IFrameTileProps) {
39+
return (
40+
<Container h="100%" w="100%" maw="initial" mah="initial" p={0}>
41+
<iframe
42+
- sandbox="" // Disables js execution see TODO: add link
43+
+ sandbox="" // Disables js execution see https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#sandbox
44+
className={classes.iframe}
45+
src={widget.properties.embedUrl}
46+
title="widget iframe"

‎CVE-2025-25904/patch.png‎

-192 KB
Binary file not shown.

0 commit comments

Comments
 (0)