PT-2021-21631 · Rpcms · Rpcms

Zhang Zhiyi · Published 2021-07-26 · Updated 2021-08-06 · CVE-2021-37392

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below

Description The issue arises from the improper sanitization of the nickname variable before it is displayed on a page. When API functions are enabled, an attacker can exploit this by updating a user's nickname with an XSS payload, achieving stored XSS. This stored XSS is triggered when users view articles published by the injected user.

Recommendations For RPCMS versions 1.8 and below, as a temporary workaround, consider disabling API functions that allow updating user nicknames until a patch is available. Restrict access to API endpoints related to user profile updates to minimize the risk of exploitation. Avoid using the nickname variable in API responses until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37392

Affected Products

Rpcms

References · 7

• 🔥 https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f · Exploit
• https://osv.dev/vulnerability/CVE-2021-37392 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37392 · Security Note
• https://t.me/cvenotify/18796 · Telegram Post
• https://github.com/ralap-z/RPCMS · Note
• https://t.me/cibsecurity/26508 · Telegram Post
• https://t.me/cvenotify/18152 · Telegram Post