CVE-2018-1000516 Galaxy cross-site scripting (XSS)
Attackers can execute arbitrary JavaScript in Galaxy users' browsers via unsanitized input in templates, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000516?
CVE-2018-1000516 is a medium-severity cross-site scripting vulnerability in n/a, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Galaxy Project Galaxy version v14.10 contains a CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability in Many templates used in the Galaxy server did not properly sanitize user's input, which would allow for cross-site scripting (XSS) attacks. In this form of attack, a malicious person can create a URL which, when opened by a Galaxy user or administrator, would allow the malicious user to execute arbitrary Javascript. that can result in Arbitrary JavaScript code execution. This attack appear to be exploitable via The victim must interact with component on page witch contains injected JavaScript code.. This vulnerability appears to have been fixed in v14.10.1, v15.01.
Weakness: CWE-79
Which versions are affected by CVE-2018-1000516?
5 open source packages ship an affected version, including galaxy-app. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
galaxy-app PyPI | All versions | 14.10.1, 15.01 |
galaxy-app PyPI | All versions | 14.10.1 |
galaxy-app PyPI | All versions | 14.10.1 |
galaxy-app PyPI | From 15.0 | 15.01 |
galaxy-app PyPI | From 15.0 | 15.01 |
Products include Galaxyproject Galaxy.
How do I fix CVE-2018-1000516?
Upgrade galaxy-app to a fixed version for your release line: 14.10.1 or 15.01.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-1000516 being exploited?
There is no known exploitation of CVE-2018-1000516 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-27578 Galaxy vulnerable to unauthorized modification of pages/visualizations due to insufficient permission check
- CVE-2022-23470 Arbitrary file access in the Galaxy data analysis platform
- CVE-2024-42346 Stored Cross Site Scripting (Stored XSS) in Galaxy
- CVE-2024-42351 Possible Data Tampering & Loss of Public Datasets in Galaxy
- CVE-2023-42812 Galaxy vulnerable to Server Side Request Forgery during data imports
Sources
Also known as GHSA-qqr6-vm23-m488, PYSEC-2018-149.