CVE-2020-15881: MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability
Summary
CVE-2020-15881: MunkiReport munki_facts module Cross-Site Scripting (XSS) vulnerability. Affects munkireport/munki_facts versions < 1.5. Fixed in 1.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MunkiReport is a package that provides a web interface for monitoring and reporting on Macs managed by Munki, a software deployment and package management system for macOS. The munki_facts module, also known as Munki Conditions, is a component of MunkiReport that allows users to gather and display information about client machines. This module is vulnerable to a Cross-Site Scripting (XSS) attack, which enables remote attackers to inject arbitrary web script or HTML into the application via the key name.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in the munki_facts module before version 1.5 of MunkiReport allows remote attackers to execute malicious scripts or inject arbitrary HTML into the application. This can lead to various security risks, including the theft of sensitive information, session hijacking, or the manipulation of user interface elements. The vulnerability originates from insufficient input sanitization, which allows user-supplied data to be interpreted as code by the application.
How To Fix
Minimum fixed version
1.5
This is the first release that contains the fix.
composer require munkireport/munki_facts:1.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest version of the munki_facts module.
Conclusion
The MunkiReport munki_facts module is vulnerable to a Cross-Site Scripting (XSS) attack, which allows remote attackers to inject arbitrary web script or HTML into the application. To mitigate this vulnerability, it is crucial to upgrade to version 1.5 or later of the munki_facts module. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for munkireport/munki_facts →
FAQ
This vulnerability allows remote attackers to execute malicious scripts or inject arbitrary HTML into the MunkiReport application, potentially leading to the theft of sensitive information or other security risks.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
There are no known public exploits specifically targeting this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to mitigate any potential risks.
Yes, this vulnerability can be exploited remotely by attackers who can send malicious requests to the vulnerable munki_facts module.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
