CVE-2024-5062 Reflected XSS through survey redirect parameter in zenml-io/zenml

What is CVE-2024-5062?

CVE-2024-5062 is a medium-severity cross-site scripting vulnerability in zenml-io/zenml, published on 30 Jun 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A reflected Cross-Site Scripting (XSS) vulnerability was identified in zenml-io/zenml version 0.57.1. The vulnerability exists due to improper neutralization of input during web page generation, specifically within the survey redirect parameter. This flaw allows an attacker to redirect users to a specified URL after completing a survey, without proper validation of the 'redirect' parameter. Consequently, an attacker can execute arbitrary JavaScript code in the context of the user's browser session. This vulnerability could be exploited to steal cookies, potentially leading to account takeover.

Weakness: CWE-79

Which versions are affected by CVE-2024-5062?

3 open source packages ship an affected version, including zenml. It affects 1 product.

Products include Zenml Zenml.

How do I fix CVE-2024-5062?

Upgrade zenml to 0.58.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-5062 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-5062 exists.

Other vulnerabilities in zenml-io/zenml

• CVE-2024-2083 Directory Traversal in zenml-io/zenml Critical 9.9
• CVE-2024-28424 Code injection in n/a High 8.8
• CVE-2024-25723 ZenML Server Remote Privilege Escalation Vulnerability High 8.8
• CVE-2024-9340 Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml High 7.5
• CVE-2024-2035 Improper Authorization in zenml-io/zenml Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3434-hc3m-8mmm, PYSEC-2024-176.