GHSA-xv6x-456v-24xh

Source

https://github.com/advisories/GHSA-xv6x-456v-24xh

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-xv6x-456v-24xh/GHSA-xv6x-456v-24xh.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xv6x-456v-24xh

Aliases

Related

CVE-2022-46181

Published

2022-12-30T00:58:09Z

Modified

2024-08-21T16:28:38.862938Z

Severity

4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator

Summary

gotify/server vulnerable to Cross-site Scripting in the application image file upload

Details

Impact

The XSS vulnerability allows authenticated users to upload .html files. With that, an attacker could execute client side scripts if another user opened a link, such as:

https://push.example.org/image/[alphanumeric string].html

An attacker could potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.

Patches

The vulnerability has been fixed in version 2.2.2.

Workarounds

You can block access to non image files via a reverse proxy in the ./image directory.

References

https://github.com/gotify/server/pull/534 https://github.com/gotify/server/pull/535

Thanks to rickshang (aka 无在无不在) for discovering and reporting this bug.

Database specific

{
    "nvd_published_at": "2022-12-29T19:15:00Z",
    "github_reviewed_at": "2022-12-30T00:58:09Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Go / github.com/gotify/server

Package

Name: github.com/gotify/server; View open source insights on deps.dev
Purl: pkg:golang/github.com/gotify/server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.2

Database specific

{
    "last_known_affected_version_range": "<= 2.2.1"
}