PT-2024-34156 · Webfeed · Webfeed

Ouuan · Published 2024-11-04 · Updated 2024-11-05 · CVE-2024-50346

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions: WebFeed versions prior to 0.9.2

Description: The issue concerns multiple HTML injection vulnerabilities that can lead to CSRF and UI spoofing attacks. A remote attacker can provide malicious RSS feeds, attracting the victim user to visit them using WebFeed. The attacker can then inject malicious HTML into the extension page, fooling the victim into sending out HTTP requests to arbitrary sites with the victim's credentials. Users are vulnerable to CSRF attacks when visiting malicious RSS feeds via WebFeed, potentially executing unwanted actions on the user's behalf on arbitrary websites.

Recommendations: For versions prior to 0.9.2, upgrade to release version 0.9.2 to address the issue. As a temporary workaround, consider avoiding the use of WebFeed to access potentially malicious RSS feeds until the upgrade is applied. Restrict access to WebFeed's functionality to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-50346

GHSA-MRC7-2Q3W-48J8

Affected Products

Webfeed

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50346.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-50346 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50346 · Security Note
• https://github.com/taoso/webfeed/commit/a2d1c1c3a98f30e0bd7a1bbcb746fae484985e6d · Note
• https://github.com/taoso/webfeed/security/advisories/GHSA-mrc7-2q3w-48j8 · Note
• https://t.me/cvenotify/100607 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1853679203171918245 · Twitter Post
• https://twitter.com/CVEnew/status/1853581162507059490 · Twitter Post
• https://t.me/cvedetector/9803 · Telegram Post