PT-2022-27792 · Unknown · Gotify Server

Rickshang · Published 2022-12-29 · Updated 2024-08-21 · CVE-2022-46181

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gotify server versions prior to 2.2.2

Description The Gotify server contains an issue that allows authenticated users to upload .html files, which can lead to the execution of client-side scripts if another user opens a link. This could potentially allow an attacker to take over the account of the user who clicked the link. The Gotify UI does not natively expose such malicious links, so an attacker would need to get the user to open the link outside of Gotify. The issue can be exploited through links such as https://push.example.org/image/[alphanumeric string].html.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 to resolve the issue. As a temporary workaround, consider blocking access to non-image files via a reverse proxy in the ./image directory.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-46181

GHSA-XV6X-456V-24XH

GO-2022-1208

Affected Products

Gotify Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46181.json · Exploit
• https://github.com/gotify/server/pull/534 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-46181 · Security Note
• https://osv.dev/vulnerability/GO-2022-1208 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46181 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xv6x-456v-24xh · Vendor Advisory
• https://github.com/gotify/server · Note
• https://github.com/gotify/server/pull/535 · Note
• https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh · Note
• https://t.me/cvenotify/40965 · Telegram Post