PT-2023-30724 · Grocy · Grocy

Nitipoom Jaroonchaipipat · Published 2023-11-15 · Updated 2023-11-28 · CVE-2023-48199

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grocy versions prior to 4.0.4

Description The issue allows attackers to inject arbitrary HTML content without script execution, occurring when user-supplied data is not properly sanitized. This enables the injection of HTML tags through parameter values, allowing manipulation of page content in the QR code detail popup. The attack often involves social engineering tactics, exploiting user trust and the application's lack of proper input handling.

Recommendations For Grocy versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'manageApiKeys' component to minimize the risk of exploitation. Avoid using user-supplied data in the QR code function until the issue is resolved.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-48199

Affected Products

Grocy

References · 8

• 🔥 https://nitipoom-jar.github.io/CVE-2023-48199 · Exploit
• https://osv.dev/vulnerability/CVE-2023-48199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48199 · Security Note
• https://github.com/grocy/grocy · Note
• https://t.me/latest_high_impact_cve/104 · Telegram Post
• https://t.me/cvenotify/60875 · Telegram Post
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48199 · Note
• https://grocy.info · Note