CVE-2022-46165 Cross-site Scripting (XSS) in Web GUI in syncthing
Attackers can execute arbitrary scripts in the Syncthing web interface via malicious file names, potentially altering settings or adding devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-46165?
CVE-2022-46165 is a medium-severity cross-site scripting vulnerability in syncthing, published on 6 Jun 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync malicious files which contain arbitrary HTML and JavaScript in the name. If the owner of another device looks over the shared folder settings and moves the mouse over the latest sync, a script could be executed to change settings for shared folders or add devices automatically. Additionally adding a new device with a malicious name could embed HTML or JavaScript inside parts of the page. As a result the webUI may be subject to a stored cross site scripting attack. This issue has been addressed in version 1.23.5. Users are advised to upgrade. Users unable to upgrade should avoid sharing folders with untrusted users.
Weakness: CWE-79
Which versions are affected by CVE-2022-46165?
3 open source packages ship an affected version, including github.com/syncthing/syncthing and syncthing. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/syncthing/syncthing Go | All versions | 1.23.5 |
github.com/syncthing/syncthing Go | All versions | 1.23.5 |
syncthing Bitnami | All versions | 1.23.5 |
Linux distribution packages (3)
syncthing SUSE:Package Hub 15 SP5 | All versions | 1.23.5-bp155.2.3.1 |
syncthing openSUSE:Leap 15.5 | All versions | 1.23.5-bp155.2.3.1 |
syncthing openSUSE:Tumbleweed | All versions | 1.23.5-1.1 |
Products include Syncthing Syncthing.
How do I fix CVE-2022-46165?
Upgrade github.com/syncthing/syncthing to 1.23.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-46165 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-46165 exists.
Other vulnerabilities in syncthing
Sources
Also known as BIT-syncthing-2022-46165, DEBIAN-CVE-2022-46165, GHSA-9rp6-23gf-4c3h, UBUNTU-CVE-2022-46165, openSUSE-SU-2023:0126-1, openSUSE-SU-2024:12984-1.