Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affecting archivebox package, versions [0,]
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ARCHIVEBOX-6016645
- published 20 Oct 2023
- disclosed 19 Oct 2023
- credit s7x
Introduced: 19 Oct 2023
CVE-2023-45815 Open this link in a new tabHow to fix?
There is no fixed version for archivebox.
Overview
archivebox is a The self-hosted internet archive.
Affected versions of this package are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') due to the wget extractor. An attacker can potentially act using your logged-in admin credentials and add/remove/modify snapshots and ArchiveBox users, and generally do anything an admin user could do by viewing an archived malicious page designed to target your ArchiveBox instance.
Note: This is only exploitable if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page.
Workaround
This vulnerability can be mitigated by disabling the wget extractor by setting archivebox config --set SAVE_WGET=False, ensuring you are always logged out, or serving only a static HTML version of your archive.
PoC
<a href="archive/1557816881/twitter.com/garethheyes/status/1126526480614416395.html" title="\u2028\u2029 op Twitter: "Another way to use throw without a semi-colon:
<script>{onerror=alert}throw 1</script>"">