CVE-2024-51498 [@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance
A malicious cobalt instance can trigger Cross-site Scripting in the web interface when users download items from a picker.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-51498?
CVE-2024-51498 is a medium-severity cross-site scripting vulnerability in imputnet cobalt, published on 4 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the `javascript:` protocol, resulting in Cross-site Scripting (XSS) when the user tries to download an item from a picker. This issue has been present since commit `66bac03e`, was mitigated in commit `97977efa` (correctly configured web instances were no longer vulnerable) and fully fixed in commit `c4be1d3a` (included in release version 10.2.1). Users are advised to upgrade. Users unable to upgrade should enable a content-security-policy.
Weakness: CWE-79
Which versions are affected by CVE-2024-51498?
How do I fix CVE-2024-51498?
No fix has been published for CVE-2024-51498 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-51498 being exploited?
There is no known exploitation of CVE-2024-51498 in the wild and no public exploit code.
Sources
Also known as GHSA-cm4c-v4cm-3735.