PT-2024-32384 · Alist+1 · Alist+1

Kevin Stubbings + 1 · Published 2024-09-30 · Updated 2024-11-15 · CVE-2024-47067

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AList versions prior to 3.29.0

Description AList, a file list program supporting multiple storages, contains a reflected cross-site scripting issue in the helper.go file. The endpoint "/i/:link name" takes a user-provided value and reflects it back in the response, which returns an application/xml response. This allows for the inclusion of HTML tags via XHTML, leading to a cross-site scripting vulnerability.

Recommendations For versions prior to 3.29.0, update to version 3.29.0 to resolve the issue. As a temporary workaround, consider restricting access to the "/i/:link name" endpoint until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47067

GHSA-8PPH-GFHP-W226

GO-2024-3190

OPENSUSE-SU-2024:0350-1

OPENSUSE-SU-2024:14447-1

OPENSUSE-SU-2024_3911-1

SUSE-SU-2024:3911-1

Affected Products

Alist

Suse

References · 74

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47067.json · Exploit
• 🔥 https://securitylab.github.com/advisories/GHSL-2023-220_Alist · Exploit
• https://github.com/alist-org/alist/commit/6100647310594868e931f3de1188ddd8bde93b78 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47067 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14447-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3190 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8pph-gfhp-w226 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-47067 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:0350-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:3911-1 · Vendor Advisory
• https://github.com/alist-org/alist · Note
• https://suse.com/security/cve/CVE-2024-9355 · Note
• https://suse.com/security/cve/CVE-2024-49381 · Note
• https://suse.com/security/cve/CVE-2024-36814 · Note
• https://suse.com/security/cve/CVE-2024-10006 · Note