PT-2023-2370 · Imgproxy · Imgproxy

Darthsim · Published 2023-01-12 · Updated 2024-08-20 · CVE-2023-1496

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions imgproxy versions prior to 3.14.0

Description The issue is related to Cross-site Scripting (XSS) - Reflected, which can be exploited by a remote attacker to perform inter-site script attacks using a specially crafted svg file. This is due to errors in handling data types. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 3.14.0, update to version 3.14.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of svg files in the imgproxy server until a patch is available. Avoid using the imgproxy server for resizing and converting image files from untrusted sources until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-02145

CVE-2023-1496

GHSA-CH9G-X9J7-RCGP

GO-2023-1651

Affected Products

Imgproxy

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1496.json · Exploit
• 🔥 https://huntr.dev/bounties/de603972-935a-401a-96fb-17ddadd282b2 · Exploit
• https://github.com/imgproxy/imgproxy/commit/62f8d08a93d301285dcd1dabcc7ba10c6c65b689 · Patch
• https://bdu.fstec.ru/vul/2023-02145 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-1496 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1496 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ch9g-x9j7-rcgp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1651 · Vendor Advisory
• https://github.com/imgproxy/imgproxy · Note
• https://t.me/cibsecurity/60290 · Telegram Post
• https://t.me/cvenotify/46470 · Telegram Post
• https://github.com/advisories/GHSA-ch9g-x9j7-rcgp · Note