{"answers":{"affected":"2 open source packages ship an affected version, including com.reposilite:reposilite-backend.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36115 exists.","fix":"Upgrade com.reposilite:reposilite-backend to 3.5.12 or later.","what":"CVE-2024-36115 is a high-severity cross-site scripting vulnerability in dzikoysk reposilite, published on 19 Jun 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-36115 and fix it if it is affected.\n\nWhat it is: CVE-2024-36115 is a high-severity cross-site scripting vulnerability in dzikoysk reposilite, published on 19 Jun 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36115 exists.\n\nAffected packages and fixed versions:\n- com.reposilite:reposilite-backend (Maven): affected from 3.3.0; fixed in 3.5.12\n- com.reposilite:reposilite-backend (Maven): affected from 3.3.0; fixed in 3.5.12\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-36115/ (Markdown: https://insights.sbomify.com/CVE-2024-36115/index.md)","id":"CVE-2024-36115","markdown":"https://insights.sbomify.com/CVE-2024-36115/index.md","name":"CVE-2024-36115","record":{"aliases":["GHSA-9w8w-34vr-65j2"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["account_takeover","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Maven repository manager","requires_auth":"low_privilege","summary":"Stored XSS in Reposilite allows attackers to steal admin tokens via malicious artifacts, leading to full instance compromise and potential remote code execution.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform administrative tasks via API. The problem lies in the fact that the artifact's content is served via the same origin (protocol/host/port) as the Admin UI. If the artifact contains HTML content with javascript inside, the javascript is executed within the same origin. Therefore, if an authenticated user is viewing the artifacts content, the javascript inside can access the browser's local storage where the user's password (aka 'token-secret') is stored. It is especially dangerous in scenarios where Reposilite is configured to mirror third party repositories, like the Maven Central Repository. Since anyone can publish an artifact to Maven Central under its own name, such malicious packages can be used to attack the Reposilite instance. This issue may lead to the full Reposilite instance compromise. If this attack is performed against the admin user, it's possible to use the admin API to modify settings and artifacts on the instance. In the worst case scenario, an attacker would be able to obtain the Remote code execution on all systems that use artifacts from Reposilite. It's important to note that the attacker does not need to lure a victim user to use a malicious artifact, but just open a link in the browser. This link can be silently loaded among the other HTML content, making this attack unnoticeable. Even if the Reposilite instance is located in an isolated environment, such as behind a VPN or in the local network, this attack is still possible as it can be performed from the admin browser. Reposilite has addressed this issue in version 3.5.12. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-072.","ecosystems":["Maven"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Stored Cross site scripting in Reposilite artifacts","id":"CVE-2024-36115","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Maven","product":null,"products":[],"type":"xss","year":"2024"},"n_packages":2,"n_references":4,"next":{"headline":"Path traversal in Reposilite javadoc file expansion","id":"CVE-2024-36116"},"packages":[{"ecosystem":"Maven","fixed":["3.5.12"],"introduced":["3.3.0"],"last_affected":[],"package":"com.reposilite:reposilite-backend","purl":null,"source":"GHSA-9w8w-34vr-65j2"},{"ecosystem":"Maven","fixed":["3.5.12"],"introduced":["3.3.0"],"last_affected":[],"package":"com.reposilite:reposilite-backend","purl":"pkg:maven/com.reposilite/reposilite-backend","source":"GHSA-9w8w-34vr-65j2"}],"prev":{"headline":"Decompressors can crash the JVM and leak memory content in Aircompressor","id":"CVE-2024-36114"},"products":["reposilite"],"published":"2024-06-19","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-08-02","vendors":["dzikoysk"]},"summary":"Stored XSS in Reposilite allows attackers to steal admin tokens via malicious artifacts, leading to full instance compromise and potential remote code execution.","url":"https://insights.sbomify.com/CVE-2024-36115/"}