PT-2022-27059 · Unknown · Csaf Provider

Damian Pfammatter · Published 2022-12-13 · Updated 2024-08-21 · CVE-2022-43996

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions csaf provider versions prior to 0.8.2

Description The issue allows for Cross-site Scripting (XSS) via a crafted CSAF document uploaded as text/html. The "upload" endpoint allows valid CSAF advisories in JSON format to be uploaded with Content-Type text/html and filenames ending in .html. When accessed via a web browser, these advisories are served and interpreted as HTML pages, allowing uploaded advisories to contain JavaScript code that executes within the browser context of users inspecting the advisory.

Recommendations For versions prior to 0.8.2, update to version 0.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "upload" endpoint to minimize the risk of exploitation. Avoid using the endpoint to upload CSAF advisories with Content-Type text/html until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-43996

GHSA-XXFX-W2RW-GH63

GO-2022-1164

Affected Products

Csaf Provider

References · 10

• 🔥 https://github.com/csaf-poc/csaf_distribution · Exploit
• 🔥 https://github.com/csaf-poc/csaf_distribution/commit/17f22855ee8d4270dd17ff748c30ed7304846fdc · Exploit
• 🔥 https://github.com/csaf-poc/csaf_distribution/releases/tag/v0.8.2 · Exploit
• https://osv.dev/vulnerability/GO-2022-1164 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43996 · Security Note
• https://osv.dev/vulnerability/GHSA-xxfx-w2rw-gh63 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-43996 · Vendor Advisory
• https://wid.cert-bund.de/.well-known/csaf/white/2022/bsi-2022-0003.json · Note
• https://t.me/cibsecurity/54475 · Telegram Post
• https://github.com/advisories/GHSA-xxfx-w2rw-gh63 · Note