PT-2023-4279 · Cockpit Hq · Cockpit

Aheinze · Published 2023-08-06 · Updated 2023-08-10 · CVE-2023-4196

Positive Technologies (AI Summary)

CVSS v2.0

8.7

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions cockpit-hq/cockpit versions prior to 2.6.3

Description The issue is related to a Cross-site Scripting (XSS) - Stored vulnerability in the cockpit-hq/cockpit GitHub repository. This vulnerability exists due to inadequate protection of the web page structure, allowing a remote attacker to conduct an XSS attack. For any role that has permission to execute function assets, an attacker can upload an HTML file, leading to XSS.

Recommendations For versions prior to 2.6.3, update to version 2.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the ability to upload HTML files and limiting the execution of function assets to trusted roles. Additionally, restrict access to sensitive areas of the web application to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-04597

CVE-2023-4196

GHSA-W3QM-93VF-5HRW

Affected Products

Cockpit

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/4xxx/CVE-2023-4196.json · Exploit
• 🔥 https://huntr.dev/bounties/c275a2d4-721f-49f7-8787-b146af2056a0 · Exploit
• https://github.com/cockpit-hq/cockpit/commit/039a00cc310bff128ca6e6c1c46c6fbad0385c2c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-4196 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4196 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w3qm-93vf-5hrw · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04597 · Security Note
• https://github.com/cockpit-hq/cockpit/commit/039a00cc310bff128ca6e6c1c46c6fbad0385c2c#diff-12da5861472233a9a9ba8f2290e65e9ee7e0f2717d410185bc402b4ab6256993 · Note
• https://github.com/cockpit-hq/cockpit · Note
• https://huntr.dev/bounties/0bd5da2f-0e29-47ce-90f3-06518656bfd6 · Note
• https://t.me/cvenotify/55872 · Telegram Post
• https://vuldb.com/ru/?id.236239 · Note
• https://t.me/cibsecurity/67835 · Telegram Post
• https://t.me/cvenotify/56191 · Telegram Post