PT-2022-16825 · Ssr-Pages · Ssr-Pages

Published 2022-03-01 · Updated 2022-03-09 · CVE-2022-24717

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ssr-pages versions prior to 0.1.5

Description A cross site scripting (XSS) issue can occur when providing untrusted input to the redirect.link property as an argument to the build(MessagePageOptions) function. This issue affects the ssr-pages HTML page builder, which is used for server-side rendering (SSR).

Recommendations For versions prior to 0.1.5, update to version 0.1.5 to resolve the issue. As a temporary workaround, consider validating and sanitizing any untrusted input provided to the redirect.link property to minimize the risk of exploitation. Restrict access to the build(MessagePageOptions) function to trusted sources until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24717

GHSA-7F63-H6G3-7CWM

Affected Products

Ssr-Pages

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24717.json · Exploit
• https://github.com/Finastra/ssr-pages/pull/2/commits/133606ffaec2edd9918d9fba5771ed21da7876a5 · Patch
• https://github.com/Finastra/ssr-pages/security/advisories/GHSA-7f63-h6g3-7cwm · Patch
• https://github.com/Finastra/ssr-pages/commit/98abc59e28fec48246be0d59ac144675d6361073 · Patch
• https://github.com/Finastra/ssr-pages/pull/2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24717 · Security Note
• https://osv.dev/vulnerability/GHSA-7f63-h6g3-7cwm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24717 · Vendor Advisory
• https://github.com/Finastra/ssr-pages · Note
• https://t.me/cibsecurity/38278 · Telegram Post