PT-2024-33493 · Umbrel · Umbrel

P- + 1 · Published 2024-11-08 · Updated 2024-11-15 · CVE-2024-49379

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Umbrel versions prior to 1.2.2

Description The login functionality of Umbrel contains a reflected cross-site scripting (XSS) vulnerability in use-auth.tsx. An attacker can specify a malicious redirect query parameter to trigger the vulnerability. If a JavaScript URL is passed to the redirect parameter, the attacker-provided JavaScript will be executed after the user enters their password and clicks on login.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider disabling the login functionality until a patch is available. Restrict access to the use-auth.tsx module to minimize the risk of exploitation. Avoid using the redirect parameter in the login functionality until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-49379

Affected Products

Umbrel

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49379.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-49379 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49379 · Vendor Advisory
• https://github.com/getumbrel/umbrel/releases/tag/1.2.2 · Note
• https://github.com/getumbrel/umbrel/commit/b83e3542650880bf1439419d00bf82285a7d2b22 · Note
• https://twitter.com/VulmonFeeds/status/1856874749676359946 · Twitter Post
• https://securitylab.github.com/advisories/GHSL-2024-164_Umbrel · Note
• https://twitter.com/GHSecurityLab/status/1854967380746612969 · Twitter Post
• https://t.me/cvedetector/10852 · Telegram Post
• https://twitter.com/CVEnew/status/1856828031555572041 · Twitter Post