CVE-2023-1384 Cross-site scripting in Fire TV Stick 3rd gen
Attackers can execute arbitrary JavaScript via unsanitized input in the setMediaSource function on Amazon Fire TV devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1384?
CVE-2023-1384 is a medium-severity cross-site scripting vulnerability in Amazon Fire TV Stick 3rd gen, published on 3 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run
This issue affects:
Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3.
Which versions are affected by CVE-2023-1384?
It affects 1 product.
Products include Amazon Fire Os.
How do I fix CVE-2023-1384?
No fix has been published for CVE-2023-1384 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-1384 being exploited?
There is no known exploitation of CVE-2023-1384 in the wild and no public exploit code.
Other vulnerabilities in Amazon Fire TV Stick 3rd gen
Sources
Also known as GHSA-37fc-xjq7-ff6p.