PT-2023-24674 · Avo · Avo

Mys7Ic · Published 2023-06-05 · Updated 2023-06-12 · CVE-2023-34103

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Avo (affected versions not specified)

Description The issue concerns some Avo fields being vulnerable to Cross Site Scripting (XSS) when rendering HTML-based content. Attackers need form edit privilege to exploit this vulnerability, but the results are stored, and no specific timing is required. This can be exploited by an attacker to store JavaScript code in any trix field by intercepting the request and modifying the post data. The impact of this vulnerability is that attackers may be able to gain access to accounts that require special protection, such as administrators of the web service.

Recommendations To resolve the issue, users are advised to configure CSP headers for their application and to limit untrusted user access as a mitigation. Additionally, the content of a field that contains HTML code should be sanitized using the according Rails helper, which uses a whitelist of known-safe tags and attributes. This security consideration should also be applied to the as html attribute because it may contain user-controlled input. As a temporary workaround, consider disabling the trix field until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-34103

GHSA-5CR9-5JX3-2G39

Affected Products

Avo

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34103.json · Exploit
• 🔥 https://github.com/avo-hq/avo/security/advisories/GHSA-5cr9-5jx3-2g39 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/avo/CVE-2023-34103.yml · Exploit
• https://github.com/avo-hq/avo/commit/7891c01e1fba9ca5d7dbccc43d27f385e5d08563 · Patch
• https://osv.dev/vulnerability/GHSA-5cr9-5jx3-2g39 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34103 · Security Note
• https://github.com/avo-hq/avo · Note
• https://github.com/avo-hq/avo/releases/tag/v2.33.3 · Note
• https://t.me/cibsecurity/64993 · Telegram Post
• https://t.me/cvenotify/51817 · Telegram Post