diff --git a/csaf_files/IT/white/2025/va-25-017-01.json b/csaf_files/IT/white/2025/va-25-017-01.json new file mode 100644 index 00000000..c6fe7aa0 --- /dev/null +++ b/csaf_files/IT/white/2025/va-25-017-01.json @@ -0,0 +1,191 @@ +{ + "document": { + "category": "csaf_vex", + "csaf_version": "2.0", + "lang": "en-US", + "publisher": { + "category": "coordinator", + "contact_details": "https://www.cisa.gov/report", + "issuing_authority": "CISA", + "name": "CISA", + "namespace": "https://www.cisa.gov/" + }, + "title": "TrueFiling authorization bypass via user-controlled keys", + "tracking": { + "current_release_date": "2025-01-17T00:00:00Z", + "generator": { + "engine": { + "name": "Secvisogram", + "version": "2.5.16" + }, + "date": "2025-01-17T05:10:36Z" + }, + "id": "VA-25-017-01", + "initial_release_date": "2025-01-17T00:00:00Z", + "status": "final", + "version": "1.0.0", + "revision_history": [ + { + "number": "1.0.0", + "summary": "Initial publication", + "date": "2025-01-17T00:00:00Z" + } + ] + }, + "distribution": { + "tlp": { + "label": "WHITE" + } + }, + "notes": [ + { + "text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).", + "title": "Legal Notice", + "category": "legal_disclaimer" + }, + { + "text": "United States", + "title": "Countries and Areas Deployed", + "category": "other" + }, + { + "text": "Information Technology", + "title": "Critical Infrastructure Sectors", + "category": "other" + }, + { + "text": "TrueFiling trusts some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information.", + "title": "Risk Evaluation", + "category": "summary" + }, + { + "text": "This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08. No user action is required.", + "title": "Recommended Practices", + "category": "general" + }, + { + "text": "Nashville, TN, United States", + "title": "Company Headquarters Location", + "category": "other" + } + ], + "references": [ + { + "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-017-01.json", + "summary": "Vulnerability Advisory VA-25-017-01 CSAF", + "category": "self" + } + ] + }, + "product_tree": { + "branches": [ + { + "category": "vendor", + "name": "i3 Verticals", + "branches": [ + { + "category": "product_name", + "name": "TrueFiling", + "branches": [ + { + "category": "product_version_range", + "name": "<3.1.112.19", + "product": { + "name": "i3 Verticals TrueFiling 0 < 3.1.112.19", + "product_id": "CSAFPID-0001" + } + }, + { + "category": "product_version", + "name": "3.1.112.19", + "product": { + "name": "i3 Verticals TrueFiling 3.1.112.19", + "product_id": "CSAFPID-0002" + } + } + ] + } + ] + } + ] + }, + "vulnerabilities": [ + { + "cve": "CVE-2024-11146", + "cwe": { + "id": "CWE-807", + "name": "Reliance on Untrusted Inputs in a Security Decision" + }, + "notes": [ + { + "category": "summary", + "text": "TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.112.19, TrueFiling trusted some client-controlled identifiers passed in URL requests to retrieve information. Platform users must self-register for an account, and once authenticated, could manipulate those identifiers to gain partial access to case information and the ability to partially change user access to case information. This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.", + "title": "Description" + }, + { + "category": "details", + "title": "SSVC", + "text": "SSVCv2/E:N/A:Y/T:P/2025-01-17T04:58:23Z/" + } + ], + "title": "TrueFiling authorization bypass via user-controlled keys", + "product_status": { + "known_affected": [ + "CSAFPID-0001" + ], + "fixed": [ + "CSAFPID-0002" + ] + }, + "references": [ + { + "category": "external", + "summary": "raw.githubusercontent.com", + "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-25-017-01.json" + } + ], + "scores": [ + { + "cvss_v3": { + "baseScore": 7.3, + "baseSeverity": "HIGH", + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", + "version": "3.1" + }, + "products": [ + "CSAFPID-0001" + ] + } + ], + "remediations": [ + { + "category": "vendor_fix", + "details": "This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.", + "product_ids": [ + "CSAFPID-0001" + ], + "date": "2024-11-08T05:00:00Z" + }, + { + "category": "vendor_fix", + "details": "This vulnerability was addressed in version 3.1.112.19 and all instances were updated by 2024-11-08.", + "product_ids": [ + "CSAFPID-0002" + ], + "date": "2024-11-08T05:00:00Z" + } + ], + "acknowledgments": [ + { + "names": [ + "Alison Breacher" + ], + "urls": [ + "https://infosec.exchange/@abreacher" + ] + } + ], + "release_date": "2025-01-17T00:00:00Z" + } + ] +} diff --git a/csaf_files/IT/white/2025/va-25-017-01.json.asc b/csaf_files/IT/white/2025/va-25-017-01.json.asc new file mode 100644 index 00000000..0661c10a --- /dev/null +++ b/csaf_files/IT/white/2025/va-25-017-01.json.asc @@ -0,0 +1,16 @@ +-----BEGIN PGP SIGNATURE----- + +iQIzBAABCAAdFiEEFErtCle+fUroNdnYysWsT3QWSxcFAmeJ/sgACgkQysWsT3QW +Sxfz4Q//RVqexx4j6FOzKtEEIWAr2DWqZl4kfVsS06oPKT3nT6qcP9bbqB9oXKSs +NAdUtq6mWNjLw7fSNWrx4ZJ8+Zh7mNI2spWWzzSsGbUJOXQAdoY1mAez5pqZsiKs +3+kRV4NxXRMU58JerQ4FcUfbAMhzUWiUR6YAo1knnIa4cgSB7aqzD17nhLaAXcAg +uSnHgoL1GoUjGGez4Em4POnnjvNNfVeeNEZMg8DOwjHd8qnPwhIzNdQOniD7BI2T +TzfTypz6YetudSIGlX36/wjfxaikAvaOUwfoX8Cq6mjedFqNaePUs+/KjChzWQ+5 +35LKIqzI+UzWvwmc+bKmnRwnbwr83qeaNMKVjWtlOjgh6Ctn2K3rcfDr7+8sxqU5 +V6bPUMbNsXf5MtXZZ4g7Lie3g/NpwSwcHg6W+SUJ/BNKK/Y/+9w348E68s8fxAyr +2hRDsoLvx/tMkUv+szqeL4adXnptmO+XOglgW8KKUxBP3HL6SNuXLC2JCmfZgldD +S2W6B5VQfpZIhQTCOIA07HMk5ZnMbVBn1iF48CoYeUbcXio+TM2wHBy7y0mf93hs +s3sK2+QLJ2fxykxcFVeMiVMURWB5/UIsYChJ1WjG5s+6a483m4NTBXTgI62GwPFz +dQ8ku+EDrupfodI20eMEJgao8fO7RxTcdAxGQzTXetY4ZyAPdTo= +=495q +-----END PGP SIGNATURE----- diff --git a/csaf_files/IT/white/2025/va-25-017-01.json.sha512 b/csaf_files/IT/white/2025/va-25-017-01.json.sha512 new file mode 100644 index 00000000..51e4c513 --- /dev/null +++ b/csaf_files/IT/white/2025/va-25-017-01.json.sha512 @@ -0,0 +1 @@ +f250a42a1f1c1304c68531755f55b397478a85f791bf57585c3b1561de2d40a8d6945ce3bd37e08039c7ecb3de6c3954fade6d6dc4bf1f7f6d244bdcdc89ddec va-25-017-01.json diff --git a/csaf_files/IT/white/changes.csv b/csaf_files/IT/white/changes.csv index 1c2700a8..4c91023a 100644 --- a/csaf_files/IT/white/changes.csv +++ b/csaf_files/IT/white/changes.csv @@ -1,3 +1,4 @@ +csaf_files/IT/white/2025/va-25-017-01.json,2025-01-17T00:00:00Z csaf_files/IT/white/2024/va-24-254-02.json,2024-11-28T01:00:00Z csaf_files/IT/white/2024/va-24-331-01.json,2024-11-26T18:15:49Z csaf_files/IT/white/2024/va-24-325-01.json,2024-11-20T18:33:57Z diff --git a/csaf_files/IT/white/cisa-csaf-it-feed-tlp-white.json b/csaf_files/IT/white/cisa-csaf-it-feed-tlp-white.json index 90a33df6..97fd10d4 100644 --- a/csaf_files/IT/white/cisa-csaf-it-feed-tlp-white.json +++ b/csaf_files/IT/white/cisa-csaf-it-feed-tlp-white.json @@ -7,6 +7,34 @@ } ], "entry": [ + { + "content": { + "src": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-017-01.json", + "type": "application/json" + }, + "format": { + "schema": "https://docs.oasis-open.org/csaf/csaf/v2.0/csaf_json_schema.json", + "version": "2.0" + }, + "id": "VA-25-017-01", + "link": [ + { + "href": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-017-01.json", + "rel": "self" + }, + { + "href": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-017-01.json.sha512", + "rel": "hash" + }, + { + "href": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-017-01.json.asc", + "rel": "signature" + } + ], + "published": "2025-01-17T00:00:00Z", + "title": "TrueFiling authorization bypass via user-controlled keys", + "updated": "2025-01-17T00:00:00Z" + }, { "content": { "src": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2024/va-24-254-02.json", @@ -212,6 +240,6 @@ } ], "title": "CISA CSAF IT feed (TLP:WHITE)", - "updated": "2024-11-27T02:33:40Z" + "updated": "2025-01-17T01:55:05Z" } } diff --git a/csaf_files/IT/white/index.txt b/csaf_files/IT/white/index.txt index 242f280e..1ec3554e 100644 --- a/csaf_files/IT/white/index.txt +++ b/csaf_files/IT/white/index.txt @@ -1,3 +1,4 @@ +csaf_files/IT/white/2025/va-25-017-01.json csaf_files/IT/white/2024/va-24-331-01.json csaf_files/IT/white/2024/va-24-325-01.json csaf_files/IT/white/2024/va-24-317-01.json