CVE-2024-37304 NuGetGallery's Markdown Autolinks Processing Vulnerable to Cross-site Scripting
Attackers can execute arbitrary JavaScript via unsanitized Markdown autolinks, potentially compromising user sessions on the NuGet Gallery platform.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-37304?
CVE-2024-37304 is a medium-severity cross-site scripting vulnerability in NuGetGallery, published on 12 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability related to its handling of autolinks in Markdown content. While the platform properly filters out JavaScript from standard links, it does not adequately sanitize autolinks. This oversight allows attackers to exploit autolinks as a vector for Cross-Site Scripting (XSS) attacks. When a user inputs a Markdown autolink such as `<javascript:alert(1)>`, the link is rendered without proper sanitization. This means that the JavaScript code within the autolink can be executed by the browser, leading to an XSS attack. Version 2024.05.28 contains a patch for this issue.
Weakness: CWE-79
Which versions are affected by CVE-2024-37304?
It affects 1 product.
Products include Microsoft Nugetgallery.
How do I fix CVE-2024-37304?
No fix has been published for CVE-2024-37304 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-37304 being exploited?
There is no known exploitation of CVE-2024-37304 in the wild and no public exploit code.
Other vulnerabilities in NuGetGallery
Sources
Also known as GHSA-gwjh-c548-f787.