GHSA-2fch-hv74-fgw9 Cross site scripting (XSS) in wwbn/avideo
Reflected XSS in aVideo allows attackers to steal admin cookies and take over accounts via crafted links.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-2fch-hv74-fgw9?
GHSA-2fch-hv74-fgw9 is a cross-site scripting vulnerability in wwbn/avideo, published on 26 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Description:
While making an account in demo.avideo.com I found a parameter "?success=" which did not sanitize any symbol character properly which leads to XSS attack.
Impact:
Since there's an Admin account on demo.avideo.com attacker can use this attack to Takeover the admin's account
Step to Reproduce:
- Click the link below
https://demo.avideo.com/user?success="><img src=x onerror=alert(document.cookie)>
- Then XSS will be executed
Which versions are affected by GHSA-2fch-hv74-fgw9?
2 open source packages ship an affected version, including wwbn/avideo.
| Package | Affected | Fixed in |
|---|---|---|
wwbn/avideo Packagist | All versions | 12.4 |
wwbn/avideo Packagist | All versions | 12.4 |
How do I fix GHSA-2fch-hv74-fgw9?
Upgrade wwbn/avideo to 12.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-2fch-hv74-fgw9 being exploited?
There is no known exploitation of GHSA-2fch-hv74-fgw9 in the wild and no public exploit code.