PT-2024-22330 · Unknown · Yourspotify

Ragingcactus · Published 2024-03-13 · Updated 2024-03-15 · CVE-2024-28196

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions YourSpotify versions prior to 1.9.0

Description The issue concerns a clickjacking vulnerability that can be used to trick an existing user into triggering actions, such as allowing signup of other users or deleting the current user account. Clickjacking works by opening the target application in an invisible iframe on an attacker-controlled site and luring a victim to visit the attacker page and interact with it. By positioning elements over the invisible iframe, a victim can be tricked into triggering malicious or destructive actions in the invisible iframe, while they think they interact with a totally different site altogether. This can result in a high impact to the integrity of YourSpotify.

Recommendations For versions prior to 1.9.0, upgrade to version 1.9.0 to address the issue. As a temporary workaround, consider restricting access to the YourSpotify instance to minimize the risk of exploitation. Avoid using YourSpotify while logged in and visiting other sites to reduce the risk of clickjacking attacks.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2024-28196

GHSA-M5X2-6HJM-CGGQ

Affected Products

Yourspotify

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28196.json · Exploit
• https://github.com/Yooooomi/your_spotify/security/advisories/GHSA-m5x2-6hjm-cggq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28196 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28196 · Security Note
• https://twitter.com/CVEnew/status/1767965840811450422 · Twitter Post
• https://twitter.com/RedPacketSec/status/1768580004609163437 · Twitter Post