GHSA-8c8c-4vfj-rrpc Reflected Cross-Site Scripting in redis-commander
Reflected XSS in redis-commander allows attackers to execute scripts if Flash is enabled, requiring user interaction via a crafted link.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-8c8c-4vfj-rrpc?
GHSA-8c8c-4vfj-rrpc is a cross-site scripting vulnerability in redis-commander, published on 1 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Affected versions of redis-commander contain a cross-site scripting vulnerability in the highlighterId paramter of the clipboard.swf component on hosts serving Redis Commander.
Mitigating factors: Flash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the Flash NPAPI Windows plugin
Proof of concept
http://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\%22))}%20catch(e)%20{alert(document.domain);}//
Recommendation
No direct patch for this vulnerability is currently available.
At this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.
Which versions are affected by GHSA-8c8c-4vfj-rrpc?
2 open source packages ship an affected version, including redis-commander.
| Package | Affected | Fixed in |
|---|---|---|
redis-commander npm | From 0.0.0 | 0.5.0 |
redis-commander npm | From 0.0.0 | 0.5.0 |
How do I fix GHSA-8c8c-4vfj-rrpc?
Upgrade redis-commander to 0.5.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-8c8c-4vfj-rrpc being exploited?
There is no known exploitation of GHSA-8c8c-4vfj-rrpc in the wild and no public exploit code.