PT-2020-20306 · Sockjs · Sockjs

Published 2020-02-10 · Updated 2021-04-13 · CVE-2020-8823

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SockJS versions prior to 0.3.0

Description The issue concerns a Reflected XSS vulnerability via the c (also known as callback) parameter in the /htmlfile endpoint. This allows for potential malicious script execution.

Recommendations For versions prior to 0.3.0, update to version 0.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /htmlfile endpoint or avoiding the use of the c parameter until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-8823

GHSA-HH8V-JMH3-9437

SNYK-JS-SOCKJS-548397

Affected Products

Sockjs

References · 9

• 🔥 https://github.com/theyiyibest/Reflected-XSS-on-SockJS · Exploit
• https://sockjs.org · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8823 · Security Note
• https://osv.dev/vulnerability/GHSA-hh8v-jmh3-9437 · Vendor Advisory
• https://github.com/theyiyibest/Reflected-XSS-on-SockJS/issues/1 · Note
• https://npmjs.com/package/sockjs · Note
• https://snyk.io/vuln/SNYK-JS-SOCKJS-548397 · Note
• https://t.me/cvenotify/5946 · Telegram Post