Vulnerabilities in VS Code, Grafana, GNU Emacs, and Apache Fineract

Several recently identified vulnerabilities:

• A critical vulnerability (CVE-2022-41034) has been discovered in Visual Studio Code (VS Code), allowing an attacker to execute code when a user opens a link prepared by the attacker. The code can be executed both on the machine with VS Code and on any other machines connected to VS Code through the 'Remote Development' feature. This issue poses the greatest risk to users of the web version of VS Code and web editors based on it, including GitHub Codespaces and github.dev.

  The vulnerability is caused by the ability to handle service links 'command:' to open a terminal window and execute arbitrary shell commands while processing specially formatted Jupyter Notebook documents loaded from tīmekļa servera, under the attacker's control (external files with the '.ipynb' extension are opened in 'isTrusted' mode without additional confirmations, allowing the processing of 'command:').

• A vulnerability (CVE-2022-45939) has been identified in the text editor GNU Emacs, allowing commands to be executed when opening a file with code by substituting special characters in the name processed via the ctags toolkit.
• An open data visualization platform, Grafana, has a vulnerability (CVE-2022-31097) allowing the execution of JavaScript code through a notification via the Grafana Alerting system. An attacker with Editor rights can prepare a specially formatted link and gain access to the Grafana interface with administrator rights if the administrator clicks on this link. The vulnerability has been fixed in Grafana releases 9.2.7, 9.3.0, 9.0.3, 8.5.9, 8.4.10, and 8.3.10.
• A vulnerability (CVE-2022-46146) in the exporter-toolkit library used to create metric export modules for Prometheus. The issue allows bypassing basic authentication.
• A vulnerability (CVE-2022-44635) in the Apache Fineract platform for creating financial services allows an unauthenticated user to achieve remote code execution. The issue is caused by inadequate escaping of the '..' characters in paths processed by the file upload component. The vulnerability has been fixed in Apache Fineract versions 1.7.1 and 1.8.1.
• Vainība (CVE-2022-46366) Java ietvars Apache Tapestry, kas ļauj izpildīt savu kodu, deserializējot īpaši veidotus datus. Problēma parādās tikai vecajā Apache Tapestry 3.x versijā, kas jau netiek atbalstīta.
• Vainības Apache Airflow sniedzējos uz Hive (CVE-2022-41131), Pinot (CVE-2022-38649), Pig (CVE-2022-40189) un Spark (CVE-2022-40954), kas noved pie tālvadības koda izpildes, augšupielādējot nejaušus failus vai aizstājot komandas uzdevumu izpildes kontekstā, nesniedzot rakstīšanas tiesības DAG failiem.

Avots: opennet.lv