CVE-2024-52793 XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems
An attacker controlling file names can execute arbitrary scripts in browsers viewing directory listings via the Deno std http file-server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-52793?
CVE-2024-52793 is a medium-severity cross-site scripting vulnerability in denoland std, published on 22 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Deno Standard Library provides APIs for Deno and the Web. Prior to version 1.0.11, `http/file-server`'s `serveDir` with `showDirListing: true` option is vulnerable to cross-site scripting when the attacker is a user who can control file names in the source directory on systems with POSIX file names. Exploitation might also be possible on other systems but less trivial due to e.g. lack of file name support for `<>` in Windows. Version 1.0.11 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2024-52793?
How do I fix CVE-2024-52793?
No fix has been published for CVE-2024-52793 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-52793 being exploited?
There is no known exploitation of CVE-2024-52793 in the wild and no public exploit code.