PT-2022-16150 · K-Box · K-Box

Philipp Fortmann · Published 2022-02-14 · Updated 2022-02-22 · CVE-2022-23637

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions K-Box versions prior to 0.33.1

Description K-Box is a web-based application to manage documents, images, videos, and geodata. A stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can, if clicked, execute untrusted javascript actions, like retrieving user cookies.

Recommendations For versions prior to 0.33.1, update to version 0.33.1, which includes a patch that allows discarding unsafe links. As a temporary workaround, consider disabling the markdown editor until a patch is available. Restrict access to the markdown file preview to minimize the risk of exploitation. Avoid using the markdown editor to preview documents until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23637

GHSA-WWCW-H4MF-MVXF

Affected Products

K-Box

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23637.json · Exploit
• https://github.com/k-box/k-box/commit/3bb4df9a4d01aade5bffaa603a514d1a5fabd214 · Patch
• https://osv.dev/vulnerability/CVE-2022-23637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23637 · Security Note
• https://github.com/k-box/k-box/security/advisories/GHSA-wwcw-h4mf-mvxf · Note
• https://t.me/cibsecurity/37468 · Telegram Post
• https://t.me/cvenotify/26761 · Telegram Post