Last active
May 22, 2024 18:55
-
-
Save SaleSlave/e23d49e7f8eb937784d15c2c2fc34fca to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
CVE-2024-35627 Cross Site Scripting (XSS) | |
Product | |
https://github.com/maptiler/tileserver-gl | |
Affected versions | |
<= 4.4.10 | |
Patched versions | |
4.5.0 | |
Description: | |
During the penetration test of TileServer GL, A reflected XSS vulnerability is discovered. The value of "key" parameter is reflected in the response, allowing an attacker to inject Javascript code into the response of the application. | |
This vulnerability can be exploited to target the users of the application, and users of other applications deployed on the same domain or website as that of the TileServer website. Successful exploit results may result in compromise of user accounts and user data. | |
Impact: | |
The impact of this vulnerability can be severe. An attacker could exploit it to target users of TileServer GL. Moreover, if other applications are deployed on the same domain or website as TileServer GL, users of those applications could also be affected, leading to a broader scope of compromise. Potentially compromising their accounts, forcing the users to perform sensitive actions, stealing sensitive data, performing CORS attacks, defacement of the web application, etc. | |
Mitigation: | |
- Encode all output data before rendering it in the response to prevent XSS attacks. | |
- Update to latest version | |
Steps to Reproduce: | |
1. Visit main page and locate vector data url under DATA section, button "Inspect" | |
For example, http://<address>:8083/data/malaysia-vector/#0/0.00000/0.00000 | |
2. Change found URL to http://<address>:8083/data/malaysia-vector/?key='-alert(1)-' | |
References: | |
https://github.com/maptiler/tileserver-gl/discussions/1248 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment