CVE-2024-50344 I, Librarian has a Stored XSS vulnerability in Supplemental Files
Attackers can execute arbitrary JavaScript in the victim's browser by uploading malicious supplemental files due to broken MIME type validation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-50344?
CVE-2024-50344 is a medium-severity cross-site scripting vulnerability in mkucej i-librarian-free, published on 30 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
I, Librarian is an open-source version of a PDF managing SaaS. Supplemental Files are allowed to be viewed in the browser, only if they have a white-listed MIME type. Unfortunately, this logic is broken, thus allowing unsafe files containing Javascript to be executed with the application context. An attacker can exploit this vulnerability by uploading a supplementary file that contains a malicious code or script. This code will then be executed when the file is loaded in the browser. The vulnerability was fixed in version 5.11.2.
Weakness: CWE-80
Which versions are affected by CVE-2024-50344?
How do I fix CVE-2024-50344?
No fix has been published for CVE-2024-50344 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-50344 being exploited?
There is no known exploitation of CVE-2024-50344 in the wild and no public exploit code.
Sources
Also known as GHSA-c2rm-w62w-5xmj.