PT-2022-16911 · Unknown · Privatebin

Ian Budd · Published 2022-04-11 · Updated 2022-04-19 · CVE-2022-24833

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrivateBin versions prior to 1.4.0

Description A cross-site scripting (XSS) issue was found in PrivateBin, which is a minimalist, open source online pastebin clone. The problem arises because SVGs can contain JavaScript, allowing an attacker to execute code if a user opens a paste with a specifically crafted SVG attachment and interacts with the preview image. This can happen if the instance isn't protected by an appropriate content security policy. The issue is present in all versions from 0.21 of the project, which was initially called ZeroBin.

Recommendations For versions prior to 1.4.0, upgrade to version 1.4.0 to resolve the issue. As a temporary workaround, ensure the content security policy of the instance is set correctly to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-24833

GHSA-CQCC-MM6X-VMVW

Affected Products

Privatebin

References · 8

• 🔥 https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-cqcc-mm6x-vmvw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24833.json · Exploit
• https://github.com/PrivateBin/PrivateBin/commit/2a4d572c1e9eb9b608d32b0cc0cb3b6c3b684eab · Patch
• https://osv.dev/vulnerability/CVE-2022-24833 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24833 · Security Note
• https://osv.dev/vulnerability/GHSA-cqcc-mm6x-vmvw · Vendor Advisory
• https://github.com/PrivateBin/PrivateBin · Note
• https://t.me/cibsecurity/40530 · Telegram Post