CVE-2019-15782: Cross-Site Scripting in webtorrent
Summary
CVE-2019-15782: Cross-Site Scripting in webtorrent. Affects webtorrent versions < 0.107.6. Fixed in 0.107.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
webtorrent is an npm package that allows users to stream torrents directly in their web browser. It provides a server-side component, torrent.createServer(), which creates a server to handle torrent requests. The server lists the title and files of a torrent on the index page. However, versions prior to 0.107.6 do not sanitize the data, making them vulnerable to Cross-Site Scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in webtorrent allows attackers to execute arbitrary JavaScript code in a victim's browser. This can be achieved by creating files with malicious payloads in their names, which are then listed on the index page without proper sanitization. Although the server only allows fetching data pieces from the torrent, the lack of input sanitization poses a risk of executing unintended code in the victim's browser.
How To Fix
Minimum fixed version
0.107.6
This is the first release that contains the fix.
npm install webtorrent@0.107.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The webtorrent package prior to version 0.107.6 is vulnerable to Cross-Site Scripting (XSS) attacks. To ensure the security of your application, it is crucial to upgrade to the latest version of the package. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for webtorrent →
FAQ
webtorrent is an npm package that enables streaming of torrents directly in web browsers.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The vulnerability in webtorrent can allow attackers to execute arbitrary JavaScript code in a victim's browser, potentially leading to unauthorized access, data theft, or other malicious activities.
To mitigate the risk, it is recommended to upgrade to version 0.107.6 or later of the webtorrent package, which includes the necessary fixes.
There is no known exploit available for this vulnerability at the moment.
