CVE-2017-18635: Cross-Site Scripting in @novnc/novnc
Summary
CVE-2017-18635: Cross-Site Scripting in @novnc/novnc. Affects @novnc/novnc versions < 0.6.2. Fixed in 0.6.2. How to fix ↓
Also tracked for
- novnc · Debian:11
The same CVE-2017-18635 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @novnc/novnc package is an open-source JavaScript library that provides a VNC client implementation for web browsers. It allows users to remotely access and control VNC servers through a web interface. The package includes various components such as the UI module, vnc_auto.html, and vnc.html. However, versions prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in @novnc/novnc arises from the lack of input validation for data received from the remote VNC server, specifically the VNC server name. This oversight enables an attacker who controls the remote server to execute arbitrary JavaScript code within the noVNC web page. This vulnerability affects users of include/ui.js, as well as users of vnc_auto.html and vnc.html. Exploitation of this vulnerability can lead to unauthorized access, data theft, or further compromise of the affected system.
How To Fix
Minimum fixed version
0.6.2
This is the first release that contains the fix.
npm install @novnc/novnc@0.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to upgrade to the patched version of the @novnc/novnc package to eliminate the risk of XSS attacks.
Conclusion
The vulnerability in @novnc/novnc versions prior to 0.6.2 exposes users to Cross-Site Scripting attacks, allowing an attacker to execute arbitrary JavaScript code within the web page. To mitigate this risk, it is crucial to upgrade to version 0.6.2 or later of the package. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for @novnc/novnc →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code within the noVNC web page, potentially leading to unauthorized access, data theft, or further compromise of the affected system.
Users of @novnc/novnc versions prior to 0.6.2 are affected by this vulnerability if they utilize include/ui.js, vnc_auto.html, or vnc.html in their applications.
While specific exploits for this vulnerability have not been disclosed, the lack of input validation in @novnc/novnc makes it susceptible to Cross-Site Scripting attacks.
No, upgrading to the patched version 0.6.2 or later is the recommended and only known mitigation for this vulnerability.
You can find more information about this vulnerability, including the CVE identifier, in the GitHub Advisory Database at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-49rv-g7w5-m8xx/GHSA-49rv-g7w5-m8xx.json
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
