PT-2024-35380 · Unknown · Weshacks Github Repository

Published 2024-11-18 · Updated 2024-11-19 · CVE-2024-52583

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WesHacks GitHub repository versions prior to 17 November 2024 or commit 93dfb83

Description The issue concerns the presence of links to Leostop, a site potentially hosting malicious injected JavaScript files, in the schedule.html page of the WesHacks GitHub repository. This malware may be used for tracking and creates 2 JavaScript files. The affected page is part of the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon.

Recommendations For versions prior to 17 November 2024 or commit 93dfb83, remove all references to Leostop from the schedule.html page to mitigate the risk. As a temporary workaround, consider restricting access to the schedule.html page until the issue is fully resolved.

Exploit

Fix

Weakness Enumeration

CWE-494

Related Identifiers

CVE-2024-52583

GHSA-462M-5C66-4PMH

Affected Products

Weshacks Github Repository

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52583.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-52583 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52583 · Security Note
• https://github.com/DefinetlyNotAI/WesHacks/commit/93dfb83cb23a8d44e81dc12424ad8a5ea05e8f96 · Note
• https://github.com/DefinetlyNotAI/WesHacks/security/advisories/GHSA-462m-5c66-4pmh · Note
• https://github.com/DefinetlyNotAI/WesHacks/commit/ea5a4112d94bfe47beb74b8a1ba9b631d10f64f0 · Note
• https://twitter.com/CVEnew/status/1858614049547985290 · Twitter Post
• https://t.me/cvedetector/11389 · Telegram Post