CVE-2019-17625

CRITICAL

Rambox - XSS

Title source: rule

Description

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.

Exploits (1)

nomisec WORKING POC 19 stars

by Ekultek · poc

https://github.com/Ekultek/CVE-2019-17625

View Code ZIP pw:eip

References (1)

[Exploit, Issue Tracking, Third Party Advisory] https://github.com/ramboxapp/community-edition/issues/2418

Scores

CVSS v3 9.0

EPSS 0.0481

EPSS Percentile 89.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Details

CWE

CWE-78 CWE-79

Status published

Products (2)

npm/Rambox 0npm

rambox/rambox 0.6.9

Published Oct 16, 2019

Tracked Since Feb 18, 2026