PT-2024-35709 · Unknown · Home-Gallery.Org
Kevin Stubbings
+1
·
Published
2024-12-19
·
Updated
2025-02-18
·
CVE-2024-53276
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Home-Gallery.org versions 1.15.0 and earlier
Description
Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. An open CORS policy in app.js may allow an attacker to view the images of home-gallery when it is using the default settings. The express middleware allows any website to make a cross-site request to home-gallery, thus allowing them to read any endpoint on home-gallery. Home-gallery is mostly safe from cross-site requests due to most of its pages requiring JavaScript, and cross-site requests such as fetch() do not render javascript. If an attacker is able to get the path of the preview images which are randomized, an attacker will be able to view such a photo. If any static files or endpoints are introduced in the future that contain sensitive information, they will be accessible to an attacker website.
Recommendations
For versions 1.15.0 and earlier, consider restricting access to the app.js file to minimize the risk of exploitation. As a temporary workaround, consider disabling the express middleware that allows cross-site requests until a patch is available. Avoid using the default settings that allow an open CORS policy. If possible, introduce authentication mechanisms to protect access to sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Home-Gallery.Org