GHSA-2hfj-cxw7-g45p

Source

https://github.com/advisories/GHSA-2hfj-cxw7-g45p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-2hfj-cxw7-g45p/GHSA-2hfj-cxw7-g45p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2hfj-cxw7-g45p

Aliases

Related

CVE-2021-39183

Published

2021-12-14T21:48:16Z

Modified

2024-08-21T14:57:03.127197Z

Severity

8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L CVSS Calculator

Summary

Unsafe inline XSS in pasting DOM element into chat

Details

Impact

Inline scripts are executed when Javascript is parsed via a paste action.

Open https://watch.owncast.online/
Copy and then paste <img src=null onerror=alert('hello')> into the chat field.
An alert should pop up.

Patches

    ⋮ 13 │    // Content security policy
    ⋮ 14 │    csp := []string{
    ⋮ 15 │        "script-src 'self' 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY='",
    ⋮ 16 │        "worker-src 'self' blob:", // No single quotes around blob:
    ⋮ 17 │    }

Will be patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.

For more information

If you have any questions or comments about this advisory: * Open an issue in owncast/owncast * Email us at gabek@real-ity.com

Database specific

{
    "nvd_published_at": "2021-12-14T20:15:00Z",
    "github_reviewed_at": "2021-12-14T20:16:10Z",
    "severity": "HIGH",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Go / github.com/owncast/owncast

Package

Name: github.com/owncast/owncast; View open source insights on deps.dev
Purl: pkg:golang/github.com/owncast/owncast

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.9