CVE-2024-29193 GHSL-2023-207 gotortc DOM-based Cross-site Scripting vulnerability
An attacker can execute arbitrary JavaScript in the victim's browser via DOM-based XSS in go2rtc, potentially leading to session hijacking or malicious actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-29193?
CVE-2024-29193 is a medium-severity cross-site scripting vulnerability in AlexxIT go2rtc, published on 4 Apr 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc’s origin. As of time of publication, no patch is available.
Weakness: CWE-79
Which versions are affected by CVE-2024-29193?
3 open source packages ship an affected version, including github.com/AlexxIT/go2rtc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/AlexxIT/go2rtc Go | All versions | 1.9.0 |
github.com/AlexxIT/go2rtc Go | All versions | 1.9.0 |
github.com/AlexxIT/go2rtc Go | All versions | 1.9.0 |
Products include Alexxit Go2rtc.
How do I fix CVE-2024-29193?
Upgrade github.com/AlexxIT/go2rtc to 1.9.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-29193 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29193 exists.
Other vulnerabilities in AlexxIT go2rtc
Sources
Also known as GHSA-rh4r-f7f7-r99m, GO-2024-3053.