CVE-2022-46181 Gotify server XSS vulnerability in the application image file upload
Authenticated users can upload HTML files to execute scripts when links are opened, potentially taking over victim accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-46181?
CVE-2022-46181 is a medium-severity cross-site scripting vulnerability in gotify server, published on 29 Dec 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
Weakness: CWE-79
Which versions are affected by CVE-2022-46181?
4 open source packages ship an affected version, including github.com/gotify/server and github.com/gotify/server/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gotify/server Go | All versions | None |
github.com/gotify/server Go | All versions | 2.2.2 |
github.com/gotify/server Go | All versions | 2.2.2 |
github.com/gotify/server/v2 Go | All versions | 2.2.2 |
Products include Gotify Server.
How do I fix CVE-2022-46181?
Upgrade github.com/gotify/server to 2.2.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-46181 being exploited?
There is no known exploitation of CVE-2022-46181 in the wild and no public exploit code.
Sources
Also known as GHSA-xv6x-456v-24xh, GO-2022-1208.