PT-2024-22797 · Gotortc · Gotortc
Jorge Rosillo
+3
·
Published
2024-04-04
·
Updated
2025-09-02
·
CVE-2024-29193
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
gotortc versions 1.8.5 and prior
Description
gotortc is a camera streaming application. The index page (
index.html) shows available streams by fetching the API on the client side, using Object.entries to iterate over the result, and appending the first item (name) using innerHTML. This leads to DOM-based cross-site scripting. When a victim visits the server, their browser executes the request against the go2rtc instance, and after the request, the browser is redirected to go2rtc, where the XSS is executed in the context of go2rtc's origin.Recommendations
As a temporary workaround, consider disabling the use of
innerHTML for appending user-supplied data until a patch is available.
Restrict access to the index.html page to minimize the risk of exploitation.
Avoid using the name variable in the affected API endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gotortc