CVE-2021-39183 Unsafe inline XSS Owncast

High 8.2 Published 14 Dec 2021 Updated 4 Aug 2024

Attackers can execute arbitrary JavaScript via pasted content in Owncast chat, potentially compromising user sessions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-39183?

CVE-2021-39183 is a high-severity cross-site scripting vulnerability in owncast, published on 14 Dec 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Owncast is an open source, self-hosted live video streaming and chat server. In affected versions inline scripts are executed when Javascript is parsed via a paste action. This issue is patched in 0.0.9 by blocking unsafe-inline Content Security Policy and specifying the script-src. The worker-src is required to be set to blob for the video player.

Weakness: CWE-79

Which versions are affected by CVE-2021-39183?

3 open source packages ship an affected version, including github.com/owncast/owncast. It affects 1 product.

Package	Affected	Fixed in
`github.com/owncast/owncast` Go	All versions	`0.0.9`
`github.com/owncast/owncast` Go	All versions	`0.0.9`
`github.com/owncast/owncast` Go	All versions	`0.0.9`

Products include Owncast Project Owncast.

How do I fix CVE-2021-39183?

Upgrade github.com/owncast/owncast to 0.0.9 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-39183 being exploited?

There is no known exploitation of CVE-2021-39183 in the wild and no public exploit code.

Sources

Also known as GHSA-2hfj-cxw7-g45p, GO-2022-0291.