PT-2023-24603 · Jstachio · Jstachio

Casid · Published 2023-05-30 · Updated 2023-06-06 · CVE-2023-33962

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions JStachio versions prior to 1.0.1

Description JStachio fails to escape single quotes ' in HTML, allowing an attacker to inject malicious code. This can be exploited to execute arbitrary JavaScript code in the context of other users visiting pages that use this template engine, leading to consequences such as session hijacking, defacement of web pages, theft of sensitive information, or propagation of malware.

Recommendations To mitigate this vulnerability, update to version 1.0.1 or later, which contains a patch for this issue. As a temporary workaround, consider using only double quotes " for HTML attributes to avoid the issue. To properly escape special characters, including single quotes, escape ' as &#39.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-33962

GHSA-GWXV-JV83-6QJR

Affected Products

Jstachio

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33962.json · Exploit
• 🔥 https://github.com/jstachio/jstachio/security/advisories/GHSA-gwxv-jv83-6qjr · Exploit
• https://github.com/jstachio/jstachio/issues/157 · Patch
• https://github.com/jstachio/jstachio/pull/158 · Patch
• https://github.com/jstachio/jstachio/commit/7b2f78377d1284df14c580be762a25af5f8dcd66 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-33962 · Security Note
• https://osv.dev/vulnerability/GHSA-gwxv-jv83-6qjr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33962 · Vendor Advisory
• https://github.com/jstachio/jstachio · Note
• https://github.com/jstachio/jstachio/releases/tag/v1.0.1 · Note
• https://t.me/cibsecurity/64800 · Telegram Post