{"answers":{"affected":"3 open source packages ship an affected version, including github.com/projectdiscovery/interactsh. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36474 exists.","fix":"Upgrade github.com/projectdiscovery/interactsh to 1.0.0 or later.","what":"CVE-2023-36474 is a high-severity cross-site scripting vulnerability in projectdiscovery interactsh, published on 28 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-36474 and fix it if it is affected.\n\nWhat it is: CVE-2023-36474 is a high-severity cross-site scripting vulnerability in projectdiscovery interactsh, published on 28 Jun 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-36474 exists.\n\nAffected packages and fixed versions:\n- github.com/projectdiscovery/interactsh (Go): affected all versions; fixed in 1.0.0\n- github.com/projectdiscovery/interactsh (Go): affected all versions; fixed in 1.0.0\n- github.com/projectdiscovery/interactsh (Go): affected all versions; fixed in 1.0.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-36474/ (Markdown: https://insights.sbomify.com/CVE-2023-36474/index.md)","id":"CVE-2023-36474","markdown":"https://insights.sbomify.com/CVE-2023-36474/index.md","name":"CVE-2023-36474","record":{"aliases":["GHSA-m36x-mgfh-8g78","GO-2022-0372"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["code_execution","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Interactsh server","requires_auth":"none","summary":"Attackers can perform subdomain takeover to execute arbitrary JavaScript in users' browsers via a default CNAME record pointing to GitHub Pages.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"interactsh","vendor":"projectdiscovery"}],"cvss":{"score":8.2,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Interactsh server settings make users vulnerable to Subdomain Takeover","id":"CVE-2023-36474","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"xss","year":"2023"},"n_packages":3,"n_references":4,"next":{"headline":"Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution","id":"CVE-2023-36475"},"packages":[{"ecosystem":"Go","fixed":["1.0.0"],"introduced":["0"],"last_affected":[],"package":"github.com/projectdiscovery/interactsh","purl":null,"source":"GHSA-m36x-mgfh-8g78"},{"ecosystem":"Go","fixed":["1.0.0"],"introduced":["0"],"last_affected":[],"package":"github.com/projectdiscovery/interactsh","purl":"pkg:golang/github.com/projectdiscovery/interactsh","source":"GHSA-m36x-mgfh-8g78"},{"ecosystem":"Go","fixed":["1.0.0"],"introduced":["0"],"last_affected":[],"package":"github.com/projectdiscovery/interactsh","purl":"pkg:golang/github.com/projectdiscovery/interactsh","source":"GO-2022-0372"}],"prev":{"headline":"CSP nonce reuse vulnerability in Discourse","id":"CVE-2023-36473"},"products":["interactsh"],"published":"2023-06-28","related":[{"cvss_score":9.3,"headline":"ProjectDiscovery Interactsh - Files or Directories Accessible to External Parties","id":"CVE-2024-5262","kev_date_added":null,"published":"2024-06-05"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2024-11-06","vendors":["projectdiscovery"]},"summary":"Attackers can perform subdomain takeover to execute arbitrary JavaScript in users' browsers via a default CNAME record pointing to GitHub Pages.","url":"https://insights.sbomify.com/CVE-2023-36474/"}