CVE-2023-36474 Interactsh server settings make users vulnerable to Subdomain Takeover
Attackers can perform subdomain takeover to execute arbitrary JavaScript in users' browsers via a default CNAME record pointing to GitHub Pages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-36474?
CVE-2023-36474 is a high-severity cross-site scripting vulnerability in projectdiscovery interactsh, published on 28 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.
Weakness: CWE-79
Which versions are affected by CVE-2023-36474?
3 open source packages ship an affected version, including github.com/projectdiscovery/interactsh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/projectdiscovery/interactsh Go | All versions | 1.0.0 |
github.com/projectdiscovery/interactsh Go | All versions | 1.0.0 |
github.com/projectdiscovery/interactsh Go | All versions | 1.0.0 |
Products include Projectdiscovery Interactsh.
How do I fix CVE-2023-36474?
Upgrade github.com/projectdiscovery/interactsh to 1.0.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-36474 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36474 exists.
Other vulnerabilities in projectdiscovery interactsh
Sources
Also known as GHSA-m36x-mgfh-8g78, GO-2022-0372.