CVE-2024-29882

HIGHNuclei

SRS DOM - XSS on JSONP callback

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-29882 has a selected CVSS score of 7.2 (high); EIP currently links 1 Nuclei template.

Description

SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 28, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

simple_realtime_server

Browse ossrs / simple_realtime_server

Default status: unknown

CVE ListBefore 5.0.210affected
6.0.0 to < 6.0.121affected

srs

Browse ossrs / srs
CVE List< 5.0.210affected
>= 6.0.0, < 6.0.121affected

Nuclei templates

1
ProjectDiscoveryHIGHHTTP API DOM - XSS on JSONP callbackCVSS 7.2

SRS is a simple, high-efficiency, real-time video server. SRS's `/api/v1/vhosts/vid-<id>?callback=<payload>` endpoint didn't filter the callback function name which led to injecting malicious javascript payloads and executing XSS ( Cross-Site Scripting). This vulnerability is fixed in 5.0.210 and 6.0.121.

Impact

Attackers can execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking or defacement.

Remediation

Upgrade Simple Realtime Server (SRS) to version 5.0.210, 6.0.121, or later that properly sanitizes the JSONP callback parameter.

WeaknessesCWE-79
Authorsrootxharsh, iamnoooob, pdresearch
Template tagscvecve2024srsdomxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Shodan: http.favicon.hash:1386054408
https://github.com/ossrs/srs/commit/244ce7bc013a0b805274a65132a2980680ba6b9d https://github.com/ossrs/srs/security/advisories/GHSA-gv9r-qcjc-5hj7

Source: ProjectDiscovery

References

2