PT-2020-18319 · Privatebin · Privatebin

Elrido · Published 2020-01-14 · Updated 2020-01-29 · CVE-2020-5223

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrivateBin versions 1.2.0 through 1.2.1 PrivateBin versions 1.3.0 through 1.3.1

Description A persistent Cross-site scripting (XSS) vulnerability is possible in PrivateBin due to unescaped HTML in user-provided attachment file names. This can lead to code execution when a visitor clicks the "Clone" button on a paste with a malicious filename. The impact is mitigated by the fact that the vulnerability is paste-specific and the deployed Content Security Policy (CSP) does not allow inline JS. However, there may be tricks to bypass the CSP, and the simple injection of HTML tags can still occur.

Recommendations For PrivateBin versions 1.2.0 through 1.2.1, upgrade to version 1.2.2 to protect against the vulnerability. For PrivateBin versions 1.3.0 through 1.3.1, upgrade to version 1.3.2 to protect against the vulnerability. As a temporary workaround, consider disabling the fileupload setting to prevent pastes from getting displayed that may contain this vulnerability, but note that this will break all existing pastes with uploads.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-5223

GHSA-8J72-P2WM-6738

Affected Products

Privatebin

References · 8

• 🔥 https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-8j72-p2wm-6738 · Exploit
• https://github.com/PrivateBin/PrivateBin/commit/8d0ac336d23cd8c98e71d5f21cdadcae9c8a26e6 · Patch
• https://osv.dev/vulnerability/GHSA-8j72-p2wm-6738 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5223 · Security Note
• https://privatebin.info/news/v1.3.2-v1.2.2-release.html · Vendor Advisory
• https://github.com/PrivateBin/PrivateBin/issues/554 · Note
• https://t.me/cvenotify/393 · Telegram Post