PT-2021-20208 · Postbird+1 · Postbird+1

Debshubra Chakraborty · Published 2021-05-25 · Updated 2024-02-14 · CVE-2021-33570

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Postbird version 0.8.4

Description The issue allows for stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL, or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.

Recommendations For Postbird version 0.8.4, consider disabling the use of IMG elements with the onerror attribute in PostgreSQL database tables until a patch is available. Restrict access to local files and PostgreSQL passwords to minimize the risk of exploitation. Avoid using the Window.localStorage and savedConnections variables in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33570

Affected Products

Postbird

Postgresql

References · 11

• 🔥❌ https://github.com/Tridentsec-io/postbird · Exploit, Deleted
• 🔥 http://packetstormsecurity.com/files/162831/Postbird-0.8.4-Cross-Site-Scripting-Local-File-Inclusion.html · Exploit
• 🔥 https://exploit-db.com/exploits/49910 · Exploit
• https://osv.dev/vulnerability/CVE-2021-33570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33570 · Security Note
• https://github.com/Paxa/postbird/issues/133 · Note
• https://github.com/Paxa/postbird/issues/134 · Note
• https://github.com/Paxa/postbird/issues/132 · Note
• https://t.me/cvenotify/15036 · Telegram Post
• http://packetstormsecurity.com/files/162872/Postbird-0.8.4-XSS-LFI-Insecure-Data-Storage.html · Note
• https://tridentsec.io/blogs/postbird-cve-2021-33570 · Note