PT-2021-22443 · Unknown · Globalnewfiles

Majavah · Published 2021-09-01 · Updated 2021-09-10 · CVE-2021-39186

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GlobalNewFiles versions prior to commit cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d

Description The GlobalNewFiles special page is vulnerable to a stored XSS due to the lack of proper input validation in the username column. This issue can be exploited by inserting malicious HTML or JavaScript code into account names. As a workaround, disallowing certain characters such as < and > from being used in account names can prevent the XSS.

Recommendations For versions prior to commit cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, update to a version that includes the patch from commit cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d to resolve the issue. As a temporary workaround, consider disallowing <, > (or other characters required to insert html/js) from being used in account names to prevent the XSS.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-39186

GHSA-57P5-HQJQ-H7VG

Affected Products

Globalnewfiles

References · 6

• 🔥 https://phabricator.miraheze.org/T7935 · Exploit
• https://github.com/miraheze/GlobalNewFiles/commit/cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-39186 · Security Note
• https://osv.dev/vulnerability/CVE-2021-39186 · Vendor Advisory
• https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-57p5-hqjq-h7vg · Note
• https://t.me/cibsecurity/28195 · Telegram Post