PT-2023-2370 · Imgproxy · Imgproxy

Darthsim · Publicado 2023-01-12 · Atualizado 2024-08-20 · CVE-2023-1496

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions imgproxy versions prior to 3.14.0

Description The issue is related to Cross-site Scripting (XSS) - Reflected, which can be exploited by a remote attacker to perform inter-site script attacks using a specially crafted svg file. This is due to errors in handling data types. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 3.14.0, update to version 3.14.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of svg files in the imgproxy server until a patch is available. Avoid using the imgproxy server for resizing and converting image files from untrusted sources until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2023-02145

CVE-2023-1496

GHSA-CH9G-X9J7-RCGP

GO-2023-1651

Produtos afetados

Imgproxy

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1496.json · Exploit
• 🔥 https://huntr.dev/bounties/de603972-935a-401a-96fb-17ddadd282b2 · Exploit
• https://github.com/imgproxy/imgproxy/commit/62f8d08a93d301285dcd1dabcc7ba10c6c65b689 · Correção
• https://github.com/imgproxy/imgproxy · Nota
• https://t.me/cibsecurity/60290 · Publicação no Telegram
• https://t.me/cvenotify/46470 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-02145 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-1496 · Nota de Segurança
• https://github.com/advisories/GHSA-ch9g-x9j7-rcgp · Nota
• https://osv.dev/vulnerability/CVE-2023-1496 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-ch9g-x9j7-rcgp · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-1651 · Aviso do Fabricante