Semaphoreui
Monthly
Semaphore UI through 2.19.12 fails to enforce project-level resource permissions on GET and HEAD requests in its GetMustCanMiddleware, letting any authenticated user holding only the low-privileged guest or task_runner role read every project's environment records. Those environment records store plaintext secrets, credentials, and passwords used to reach managed infrastructure, so a read-only account can effectively harvest the keys to the entire estate. Publicly available exploit code exists (tracked by VulnCheck, issue #4150), the flaw is rated 7.1 with a network attack vector and low privileges required, and no CISA KEV listing has been observed at time of analysis.
Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute arbitrary shell commands on the Semaphore server host by injecting git arguments through a crafted repository git_url value. The root cause (CWE-88, Argument Injection) lies in the default cmd_git client passing user-supplied input unsanitized to the system git binary, enabling exploitation via git's --upload-pack= option to specify an arbitrary server-side command. No public exploit code has been confirmed at time of analysis, but the --upload-pack argument injection technique is extensively documented in open-source security research and requires no specialized tooling for any holder of the requisite project role.
Argument (git option) injection in Semaphore UI before 2.18.17 and 2.19.5-beta2 lets a project Manager or Owner achieve OS command execution on the server by supplying a repository git_url beginning with a dash (e.g. --upload-pack=/tmp/evil.sh). The malicious URL is passed as a positional argument to the git binary via CmdGitClient.GetLastRemoteCommitHash, triggered both by POST /api/project/{id}/repositories and by scheduled commit-hash polling, so exploitation can fire automatically without further attacker action. No public exploit identified at time of analysis, though the fixing commits and a detailed GHSA advisory publicly document the mechanism.
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by exploiting a role-shadowing flaw in the custom role creation API. Affected versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 permit a project manager to POST a custom role with a slug matching a built-in role name and bitmask 15, causing the middleware to resolve the database-backed custom role instead of the protected built-in, thereby granting CanUpdateProject and CanManageProjectUsers capabilities reserved for owners. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the low exploitation complexity (AC:L, single API call, no special configuration) and high CVSS impact (8.8) make upgrading urgent for any deployment with untrusted project managers.
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticated user's password - including administrator accounts - by luring them to a malicious page that silently issues a cross-site POST to /api/users/{id}/password. The session cookie was issued without SameSite restrictions, causing browsers to attach it automatically to cross-origin requests, and the endpoint performed no CSRF token validation or current-password confirmation before accepting the change. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially constructable by anyone familiar with basic CSRF techniques.
Semaphore UI through 2.19.12 fails to enforce project-level resource permissions on GET and HEAD requests in its GetMustCanMiddleware, letting any authenticated user holding only the low-privileged guest or task_runner role read every project's environment records. Those environment records store plaintext secrets, credentials, and passwords used to reach managed infrastructure, so a read-only account can effectively harvest the keys to the entire estate. Publicly available exploit code exists (tracked by VulnCheck, issue #4150), the flaw is rated 7.1 with a network attack vector and low privileges required, and no CISA KEV listing has been observed at time of analysis.
Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute arbitrary shell commands on the Semaphore server host by injecting git arguments through a crafted repository git_url value. The root cause (CWE-88, Argument Injection) lies in the default cmd_git client passing user-supplied input unsanitized to the system git binary, enabling exploitation via git's --upload-pack= option to specify an arbitrary server-side command. No public exploit code has been confirmed at time of analysis, but the --upload-pack argument injection technique is extensively documented in open-source security research and requires no specialized tooling for any holder of the requisite project role.
Argument (git option) injection in Semaphore UI before 2.18.17 and 2.19.5-beta2 lets a project Manager or Owner achieve OS command execution on the server by supplying a repository git_url beginning with a dash (e.g. --upload-pack=/tmp/evil.sh). The malicious URL is passed as a positional argument to the git binary via CmdGitClient.GetLastRemoteCommitHash, triggered both by POST /api/project/{id}/repositories and by scheduled commit-hash polling, so exploitation can fire automatically without further attacker action. No public exploit identified at time of analysis, though the fixing commits and a detailed GHSA advisory publicly document the mechanism.
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by exploiting a role-shadowing flaw in the custom role creation API. Affected versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 permit a project manager to POST a custom role with a slug matching a built-in role name and bitmask 15, causing the middleware to resolve the database-backed custom role instead of the protected built-in, thereby granting CanUpdateProject and CanManageProjectUsers capabilities reserved for owners. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the low exploitation complexity (AC:L, single API call, no special configuration) and high CVSS impact (8.8) make upgrading urgent for any deployment with untrusted project managers.
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticated user's password - including administrator accounts - by luring them to a malicious page that silently issues a cross-site POST to /api/users/{id}/password. The session cookie was issued without SameSite restrictions, causing browsers to attach it automatically to cross-origin requests, and the endpoint performed no CSRF token validation or current-password confirmation before accepting the change. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is trivially constructable by anyone familiar with basic CSRF techniques.