PT-2023-30517 · Scrypted · Scrypted

Kevin Stubbings + 1 · Published 2023-12-13 · Updated 2024-08-05 · CVE-2023-47620

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Scrypted versions 0.55.0 and prior

Description A reflected cross-site scripting vulnerability exists in the plugin-http.ts file via the owner and pkg parameters, allowing an attacker to run arbitrary JavaScript code. This issue may lead to Remote Code Execution. Two reflected Cross-Site Scripting (XSS) vulnerabilities exist in scrypted that may allow an attacker to impersonate any user who clicks on specially crafted links. In the worst case, an attacker may be able to impersonate an administrator and run arbitrary commands.

Recommendations To remediate, ensure that parameters are not reflected back in the response. In addition, on error responses where html is unnecessary, set the text/plain Content-Type to prevent XSS. Ensure user-controlled data is not placed into the DOM. Additionally, validate the redirect uri parameter to prevent open redirect vulnerabilities. As a temporary workaround, consider restricting access to the vulnerable plugin-http.ts file and the Login.vue page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-47620

GHSA-W4HV-VMV9-HGCR

GHSA-XMHH-XRCC-MX36

Affected Products

Scrypted

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/47xxx/CVE-2023-47620.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-218_GHSL-2023-219_scrypted · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-47620 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47620 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w4hv-vmv9-hgcr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xmhh-xrcc-mx36 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47623 · Security Note
• https://github.com/koush/scrypted/blob/v0.55.0/plugins/core/ui/src/Login.vue#L79 · Note
• https://github.com/koush/scrypted/blob/71cbe83a2a20f743342df695ca7b98482b73e60f/server/src/plugin/plugin-http.ts#L45 · Note
• https://github.com/koush/scrypted · Note
• https://github.com/koush/scrypted/releases/tag/v0.55.0 · Note
• https://github.com/koush/scrypted/security/advisories/GHSA-w4hv-vmv9-hgcr · Note
• https://github.com/koush/scrypted/blob/71cbe83a2a20f743342df695ca7b98482b73e60f/server/package.json · Note
• https://github.com/koush/scrypted/blob/v0.55.0/plugins/core/package.json · Note
• https://t.me/cvenotify/64168 · Telegram Post