medium6.1

CVE-2023-40024

Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint

Impact

### Summary In the `/license/` endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist. ### Details In the `/license/` endpoint, the `license_details_view` function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the `key` parameter. This vulnerability arises when attempting to access a key with malicious javascript. ```python def license_details_view(request, key): """ Display all available information about a given license `key` followed by the full license text. """ licenses = get_licenses() try: data = saneyaml.dump(licenses[key].to_dict()) text = licenses[key].text except KeyError: return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>") ``` ### PoC 1. Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/ ### Impact Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the `license_details_view` function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.

Affected packages

Ecosystem	Package	Affected	Fixed in
pip	`scancodeio`	<= 32.5.1	32.5.2

Affected products

Vendor	Product	Affected versions
Nexb	Scancode.Io	through 32.5.1

Weakness classification

CWE-79

Impact

Affected packages

Affected products

Weakness classification

References