PT-2024-12301 · Norman · Norman Api

Diego95Root + 1 · Published 2024-02-08 · Updated 2024-10-16 · CVE-2023-32193

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Norman API versions prior to the patched versions

Description A vulnerability has been identified in Norman's public API endpoint, allowing unauthenticated cross-site scripting (XSS) to be exploited. This can lead to an attacker triggering JavaScript code and executing commands remotely. The attack vector was identified as a Reflected XSS, where the API propagates malicious payloads from user input to the UI, rendering the output. For example, a malicious URL can be rendered into a script that is executed on a page.

Recommendations To resolve the issue, update Norman API to a patched version, such as those including commits 3bb70b7, a6a6cf5, cb54924, 7b2b467, or bd13c65. As a temporary workaround, consider implementing security measures to encode input from the request URL before adding it to the response, and escape request input by changing the URL construction to use url.URL and escaping JavaScript and CSS variables with attribute encoding.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2023-32193

GHSA-R8F4-HV23-6QP6

GO-2024-2536

Affected Products

Norman Api

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2023-32193 · Security Note
• https://osv.dev/vulnerability/GO-2024-2536 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-32193 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r8f4-hv23-6qp6 · Vendor Advisory
• https://github.com/rancher/norman/security/advisories/GHSA-r8f4-hv23-6qp6 · Note
• https://github.com/rancher/norman/commit/bd13c653293b9b5e0b37e8a6ccd1c3277f4623ed · Note
• https://github.com/rancher/norman/commit/3bb70b772b52297feac64f5fdeb1b13c06c37e39 · Note
• https://github.com/rancher/norman · Note
• https://github.com/rancher/norman/commit/7b2b467995e6dfab6d4a5dee8dffc15033ae8269 · Note
• https://github.com/rancher/norman/commit/a6a6cf5696088c32002953d36b75bdcc84f2399e · Note
• https://github.com/rancher/norman/commit/cb54924f25c7666511a913cd41834299ef22dba4 · Note
• https://t.me/cvedetector/8062 · Telegram Post
• https://twitter.com/CveFindCom/status/1846529475602682225 · Twitter Post
• https://twitter.com/CVEnew/status/1846537265687756865 · Twitter Post
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32193 · Note