PT-2022-16165 · Unknown · Zulip Server

Andersk · Published 2022-03-02 · Updated 2022-03-09 · CVE-2022-23656

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zulip Server versions from June 2021 through main branch before 2022-03-01

Description The issue affects the recent topics page of Zulip Server, where an attacker could exploit a cross-site scripting vulnerability by crafting a malicious full name for their account and sending messages to a topic with multiple participants. If a victim opens an overflow tooltip including this full name, it could trigger the execution of JavaScript code controlled by the attacker.

Recommendations For Zulip Server versions from June 2021 through main branch before 2022-03-01, upgrade from main to a version 2022-03-01 or later to deploy the fix. As a temporary workaround, consider restricting access to the recent topics page or disabling the overflow tooltip feature until the upgrade is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23656

GHSA-FC77-H3JC-6MFV

Affected Products

Zulip Server

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23656.json · Exploit
• https://github.com/zulip/zulip/commit/e090027adcbf62737d5b1f83a9618a9500a49321 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23656 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23656 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-fc77-h3jc-6mfv · Note
• https://t.me/cibsecurity/38328 · Telegram Post