CVE-2020-15500: Cross-site scripting in TileServer GL
Summary
CVE-2020-15500: Cross-site scripting in TileServer GL. Affects tileserver-gl versions < 3.1.0. Fixed in 3.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TileServer GL is an open-source map tile server that serves vector tiles and raster tiles based on Mapbox GL JS style files. It allows users to create their own map tile server using their own data sources. The vulnerability in TileServer GL version 3.0.0 and below allows for cross-site scripting (XSS) attacks. This means that an attacker can inject malicious code into the application's main page, which will then be executed by unsuspecting users.
Vulnerability Detail
The vulnerability arises from the unsanitized reflection of the content of the 'key' GET parameter in an HTTP response for the application's main page. This allows an attacker to craft a URL with a malicious payload in the 'key' parameter, which will be executed when the page is loaded by a victim. The impact of this vulnerability can range from stealing sensitive user information to performing actions on behalf of the user without their consent.
How To Fix
Minimum fixed version
3.1.0
This is the first release that contains the fix.
npm install tileserver-gl@3.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the 'key' parameter before it is reflected in the HTTP response. This can be done by using a library or function that escapes or removes any potentially malicious characters from the parameter value.
Conclusion
The vulnerability in TileServer GL version 3.0.0 and below allows for cross-site scripting attacks, which can have serious consequences such as data theft and unauthorized actions. It is crucial to upgrade to version 3.1.0 or above to fix the vulnerability. If immediate upgrading is not possible, manual sanitization of the 'key' parameter can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tileserver-gl →
FAQ
The vulnerability allows for cross-site scripting attacks, which can lead to the execution of malicious code on the victim's browser. This can result in the theft of sensitive information or unauthorized actions performed on behalf of the user.
You can use the Vulert playground at Vulert Scanner to check if your version of TileServer GL is affected by this vulnerability. Simply provide the package-lock.json file of your application and Vulert will analyze it for any known vulnerabilities.
Yes, a fix is available in TileServer GL version 3.1.0 and above. It is recommended to upgrade to the latest version to ensure the vulnerability is patched.
While upgrading to the latest version is the recommended solution, you can mitigate the risk by manually sanitizing the 'key' parameter before it is reflected in the HTTP response. This involves removing or escaping any potentially malicious characters from the parameter value.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability in TileServer GL. However, it is important to patch the vulnerability as soon as possible to prevent any potential exploitation.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
