copyparty@0.12.10 vulnerabilities

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the WEEKEND-PLANS field. An attacker can execute arbitrary code in the context of the affected application by submitting a specially crafted payload.

There is no fixed version for copyparty.

Affected versions of this package are vulnerable to Denial of Service (DoS) via the filter parameter in the Recent Uploads page. An attacker can cause the server to become unresponsive by submitting specially crafted regular expressions.

Note: This is exploitable if the Recent Uploads feature is enabled (which is the default).

Upgrade copyparty to version 1.18.9 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via improper sanitization of multimedia tags in music files, including m3u files. An attacker can execute arbitrary JavaScript code in a victim's browser by tricking the victim into opening a crafted file.

Upgrade copyparty to version 1.18.5 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the filter parameter in the recent uploads page. An attacker can execute arbitrary JavaScript code in the context of a user's browser by crafting a malicious URL containing a specially crafted filter value.

Upgrade copyparty to version 1.18.7 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the drag-drop action on the Web-UI. An attacker can execute arbitrary JavaScript with the same privileges as the user by tricking them into dragging a maliciously-named, zero-byte file into the interface.

Note:

This vulnerability does not require the file to be uploaded to trigger the malicious script.

Upgrade copyparty to version 1.16.15 or higher.

Affected versions of this package are vulnerable to Race Condition when navpane is closed

Upgrade copyparty to version 1.0.10 or higher.

Affected versions of this package are vulnerable to Race Condition resulting in a loss of availability.

Upgrade copyparty to version 1.8.2 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization via URL-parameter ?k304=... and ?setck=.... An attacker might be able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link.

Note:

It is recommended to change account passwords unless log inspection did not produce any trace of attacks.

IoCs:

(gzip -dc access.log*.gz; cat access.log) | sed -r 's/" [0-9]+ .*//' | grep -iE '%0[da]%0[da]%0[da]%0[da]|[?&](hc|pw)=.*[<>]'

Upgrade copyparty to version 1.8.7 or higher.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via hc parameter.

Upgrade copyparty to version 1.8.6 or higher.

Affected versions of this package are vulnerable to Directory Traversal in the handle_get() function under httpcli.py. The .cpr subfolder exposes files, directories, and commands outside the web document root directory.

Upgrade copyparty to version 1.8.2 or higher.