PT-2018-9432 · Medis · Medis

Silviavali · Published 2018-06-26 · Updated 2018-08-27 · CVE-2018-1000536

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Medis versions 0.6.1 and earlier

Description The issue allows for unauthorized code execution on the victim's machine, within the rights of the running application, due to a XSS vulnerability evolving into code execution. This is caused by enabled nodeIntegration for the renderer process vulnerability in the Key name parameter on new key creation. The attack can be exploited when the victim is synchronizing data from the redis server that contains malicious key value.

Recommendations For Medis versions 0.6.1 and earlier, consider disabling the nodeIntegration for the renderer process as a temporary workaround until a patch is available. Restrict access to the Key name parameter on new key creation to minimize the risk of exploitation. Avoid synchronizing data from untrusted redis servers to prevent potential attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-1000536

Affected Products

Medis

References · 3

• 🔥 https://github.com/luin/medis/issues/109 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000536 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1000536 · Vendor Advisory