Reflected Cross-Site Scripting in redis-commander

published 2020-09-01 6y ago modified 2022-03-04 4y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander.

Mitigating factors: Flash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the [Flash NPAPI Windows plugin](https://get.adobe.com/flashplayer/otherversions/)

## Proof of concept

``` http://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\%22))}%20catch(e)%20{alert(document.domain);}// ```

## Recommendation

No direct patch for this vulnerability is currently available.

At this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.

Patch / fix

fixed in 1 links 2

npm redis-commander 0.5.0

Is GHSA-8c8c-4vfj-rrpc in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	redis-commander	>=0.0.0, <0.5.0	0.5.0

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-8c8c-4vfj-rrpc

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.