PT-2024-12300 · Episerver · Pi Server

Diego95Root + 1 · Published 2024-02-08 · Updated 2024-10-21 · CVE-2023-32192

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions API Server versions prior to the patched versions, including master, release/v2.8, release/v2.8.s3, release/v2.7, release/v2.7.s3, and release/v2.6, with specific commits: 4fd7d82, 69b3c2b, a3b9e37, 4e102cf, 97a10a3, and 4df268e.

Description A vulnerability has been identified in the API Server's public API endpoint, allowing unauthenticated cross-site scripting (XSS) to be exploited. This enables an attacker to execute arbitrary JavaScript code in the victim's browser. The attack vector is a Reflected XSS, where the API Server propagates malicious payloads from user input to the UI, rendering the output. For example, a malicious URL can be rendered into a script that is executed on a page.

Recommendations To resolve the issue, update the API Server to a patched version, including the specific commits: 4fd7d82, 69b3c2b, a3b9e37, 4e102cf, 97a10a3, and 4df268e, for the respective branches: master, release/v2.8, release/v2.8.s3, release/v2.7, release/v2.7.s3, and release/v2.6. As a temporary workaround, consider restricting access to the API Server's public API endpoint until a patch is applied. Additionally, consider encoding input that comes from the request URL before adding it to the response, and escaping the request input by changing the URL construction to use url.URL and escaping JavaScript and CSS variables with attribute encoding as defined by OWASP.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2023-32192

GHSA-833M-37F7-JQ55

GO-2024-2534

Affected Products

Pi Server

References · 17

• https://osv.dev/vulnerability/GO-2024-2534 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32192 · Security Note
• https://osv.dev/vulnerability/GHSA-833m-37f7-jq55 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32192 · Vendor Advisory
• https://github.com/rancher/apiserver/security/advisories/GHSA-833m-37f7-jq55 · Note
• https://github.com/rancher/apiserver/commit/4e102cf0d07b1af3d10d82c3e5a751a869b8a6c7 · Note
• https://github.com/rancher/apiserver/commit/4df268e250f625fa323349062636496e0aeff4e4 · Note
• https://github.com/rancher/apiserver/commit/97a10a30200cb851afd8ee85ee6b2295c4b6e5ee · Note
• https://github.com/rancher/apiserver/commit/69b3c2b56f3fa5a421889c533dada8cd08783cda · Note
• https://github.com/rancher/apiserver · Note
• https://github.com/rancher/apiserver/commit/4fd7d821d952510bfe38c9d4a3e2a65157f50525 · Note
• https://github.com/rancher/apiserver/commit/a3b9e3721c1b558ee63aec9594e37c223a5c8437 · Note
• https://twitter.com/cracbot/status/1848242938054361573 · Twitter Post
• https://twitter.com/CveFindCom/status/1846529541457563714 · Twitter Post
• https://t.me/cvedetector/8061 · Telegram Post