PT-2019-8548 · Novnc+2 · Novnc+2

David Wyde · Published 2017-11-16 · Updated 2022-04-06 · CVE-2017-18635

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions noVNC versions prior to 0.6.2

Description A Cross-Site Scripting (XSS) issue was discovered in noVNC, where a remote VNC server could inject arbitrary HTML into the noVNC web page via messages propagated to the status field, such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. The issue affects users of include/ui.js and users of vnc auto.html and vnc.html.

Recommendations Upgrade to version 0.6.2 or later. As a temporary workaround, consider restricting input from the remote VNC server to minimize the risk of exploitation. Avoid using the VNC server name variable in the affected noVNC web page until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2017-2653

CVE-2017-18635

DLA-1946-1

DLA-2854-1

GHSA-49RV-G7W5-M8XX

MGASA-2020-0374

RHSA-2020:0754

RHSA-2020:3247

USN-4522-1

Affected Products

Alt Linux

Ubuntu

Novnc

References · 32

• 🔥 https://github.com/ShielderSec/cve-2017-18635 · Exploit
• 🔥 https://github.com/ShielderSec/CVE-2017-18635 · Exploit
• 🔥 https://shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack · Exploit
• https://github.com/novnc/noVNC/issues/748 · Patch
• https://github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534 · Patch
• https://cve.org/CVERecord?id=CVE-2017-18635 · Security Note
• https://osv.dev/vulnerability/USN-4522-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18635 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-18635 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0374 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18635 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-18635 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0374.html · Security Note
• https://osv.dev/vulnerability/DLA-2854-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-18635 · Vendor Advisory