PT-2023-31626 · Github · Octokit/Webhooks+1

Nickfloyd + 2 · Publicado 2023-12-15 · Atualizado 2023-12-19 · CVE-2023-50728

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions octokit/webhooks versions 9.26.0 through 9.26.2 octokit/webhooks versions 10.9.0 through 10.9.1 octokit/webhooks versions 11.1.0 through 11.1.1 octokit/webhooks versions 12.0.0 through 12.0.3

Description The issue is caused by a problem with error handling in the @octokit/webhooks library, where the error can be undefined in some cases, resulting in an uncaught exception that ends the nodejs process. This problem was encountered during a pentest and is specifically related to the octokit/webhooks library, a dependency of Probot, a framework for building Github Apps.

Recommendations For octokit/webhooks versions 9.26.0 through 9.26.2, update to version 9.26.3. For octokit/webhooks versions 10.9.0 through 10.9.1, update to version 10.9.2. For octokit/webhooks versions 11.1.0 through 11.1.1, update to version 11.1.2. For octokit/webhooks versions 12.0.0 through 12.0.3, update to version 12.0.4. As a general recommendation, it is advised to upgrade to the latest version of octokit/webhooks.js or use one of the updated backported versions.

Exploit

Correção

Improper Handling of Exceptional Conditions

Enumeração de Fraquezas

CWE-755

Identificadores relacionados

CVE-2023-50728

GHSA-PWFR-8PQ7-X9QV

Produtos afetados

Probot

Octokit/Webhooks

Referências · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50728.json · Exploit
• https://github.com/probot/probot/releases/tag/v12.3.3 · Nota
• https://github.com/octokit/octokit.js/releases/tag/v3.1.2 · Nota
• https://github.com/octokit/webhooks.js/security/advisories/GHSA-pwfr-8pq7-x9qv · Aviso do Fabricante
• https://github.com/octokit/webhooks.js · Nota
• https://github.com/octokit/webhooks.js/releases/tag/v9.26.3 · Nota
• https://github.com/octokit/webhooks.js/releases/tag/v11.1.2 · Nota
• https://github.com/octokit/webhooks.js/releases/tag/v12.0.4 · Nota
• https://github.com/octokit/webhooks.js/releases/tag/v10.9.2 · Nota
• https://github.com/octokit/app.js/releases/tag/v14.0.2 · Nota
• https://twitter.com/CVEnew/status/1735946014710993098 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-50728 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-pwfr-8pq7-x9qv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-50728 · Aviso do Fabricante