PT-2021-19919 · Poddycast+1 · Poddycast+1

Jamie Slome + 1 · Published 2021-08-03 · Updated 2022-04-25 · CVE-2021-32772

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Poddycast versions prior to 0.8.1

Description The application does not clean the HTML characters of the podcast information obtained from the Feed, which allows the injection of HTML and JS code, resulting in cross-site scripting. As Poddycast is made with Electron, this cross-site scripting can be scaled to remote code execution, making it possible to execute commands on the machine where the application is running.

Recommendations For versions prior to 0.8.1, update to version 0.8.1 to resolve the issue. As a temporary workaround, consider restricting the use of podcast information obtained from untrusted Feeds to minimize the risk of exploitation.

Fix

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

CVE-2021-32772

GHSA-WJMH-9FJ2-RQH6

Affected Products

Electron

Poddycast

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-32772 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32772 · Vendor Advisory
• https://github.com/MrChuckomo/poddycast/blob/8d31daa5cee04a389ec35f974959ea3fe4638be9/app/js/feed.js#L285 · Note
• https://github.com/MrChuckomo/poddycast/security/advisories/GHSA-wjmh-9fj2-rqh6 · Note
• https://github.com/MrChuckomo/poddycast/blob/8d31daa5cee04a389ec35f974959ea3fe4638be9/app/js/helper/helper_entries.js#L80 · Note
• https://github.com/MrChuckomo/poddycast/blob/8d31daa5cee04a389ec35f974959ea3fe4638be9/app/js/favorite.js#L4-L14 · Note
• https://t.me/cibsecurity/26748 · Telegram Post