PT-2023-17227 · Snyk · Snyk Advisor

Gal Weizman · Published 2023-04-20 · Updated 2023-04-28 · CVE-2023-1767

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Snyk Advisor versions prior to 28th March 2023

Description The issue concerns a stored XSS vulnerability. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.

Recommendations For versions prior to 28th March 2023, consider disabling the feature that displays the contents of a scanned package's Readme on its package health page until a patch is available. Restrict access to the package health page to minimize the risk of exploitation. Avoid using the Snyk Advisor website until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-1767

Affected Products

Snyk Advisor

References · 7

• 🔥 https://weizman.github.io/2023/04/10/snyk-xss · Exploit
• https://osv.dev/vulnerability/CVE-2023-1767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1767 · Security Note
• https://support.snyk.io/hc/en-us/articles/10146704933405 · Vendor Advisory
• https://t.me/cvenotify/48688 · Telegram Post
• https://t.me/cibsecurity/62510 · Telegram Post
• https://t.me/cvenotify/49262 · Telegram Post