PT-2022-28160 · Projectdiscovery · Interactsh Server

Govulnbot · Published 2022-01-27 · Updated 2024-08-21 · CVE-2023-36474

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Interactsh server versions prior to 1.0.0

Description Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e app. Interactsh server used to create cname entries for app pointing to projectdiscovery.github.io as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain.

Recommendations Update to Interactsh server v1.0.0 with go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-server@latest to fix the issue by making CNAME optional, rather than default. As a temporary workaround, consider removing the CNAME entry for the app subdomain to prevent subdomain takeover.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-36474

GHSA-M36X-MGFH-8G78

GO-2022-0372

Affected Products

Interactsh Server

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36474.json · Exploit
• https://github.com/projectdiscovery/interactsh/security/advisories/GHSA-m36x-mgfh-8g78 · Vendor Advisory
• https://github.com/projectdiscovery/interactsh/pull/155 · Patch
• https://osv.dev/vulnerability/CVE-2023-36474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36474 · Security Note
• https://osv.dev/vulnerability/GHSA-m36x-mgfh-8g78 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0372 · Vendor Advisory
• https://github.com/projectdiscovery/interactsh/issues/136 · Note
• https://github.com/projectdiscovery/interactsh · Note
• https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more · Note
• https://t.me/cibsecurity/65703 · Telegram Post
• https://t.me/cvenotify/53253 · Telegram Post