Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Github Security Lab Vulnerability Report #344

Closed
Kwstubbs opened this issue Oct 9, 2024 · 2 comments
Closed

Github Security Lab Vulnerability Report #344

Kwstubbs opened this issue Oct 9, 2024 · 2 comments
Labels

Comments

@Kwstubbs
Copy link

Kwstubbs commented Oct 9, 2024

Hello,

Github Security Lab has found a potential vulnerability in plenti. Please let us know a good point of contact to disclose privately. Github has Private Vulnerability Reporting if you need a private point of contact.

Kevin

@jimafisk
Copy link
Member

jimafisk commented Oct 9, 2024

Hi @Kwstubbs,

Thanks for reaching out, I just enabled private vulnerability reporting in the project settings. Please just let me know if you need anything else from me to disclose the issue. Thank you for flagging this to me!

@jimafisk
Copy link
Member

The issue here was that the /postlocal endpoint could have been used to create/edit/delete files outside of your project root. So if you were running a project where someone ejected core files and inserted something malicious to the local publishing workflow, it could impact files on your computer that you did not intend.

This should be fixed in v0.7.2 so only files within the project root can be edited via the /postlocal endpoint. It's recommended to upgrade to this version for security, especially if using themes or collaborating on a project you did not personally create.

Thanks for flagging this to me @Kwstubbs!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants