CVE-2020-35774: Cross-site Scripting in TwitterServer
Summary
CVE-2020-35774: TwitterServer Cross-site Scripting via /histograms endpoint. Affects com.twitter:twitter-server_2.12 versions < 20.12.0. Fixed in 20.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TwitterServer is an open-source library developed by Twitter that provides a framework for building highly scalable and robust servers in Scala. It offers various features such as request routing, service discovery, and monitoring. The library is commonly used in web applications to handle HTTP requests and manage server resources. However, an XSS vulnerability has been identified in TwitterServer, specifically in the /histograms endpoint.
Vulnerability Detail
The vulnerability in TwitterServer allows for cross-site scripting (XSS) attacks through the /histograms endpoint. This endpoint, under certain configurations, does not properly sanitize user input, allowing malicious actors to inject and execute arbitrary JavaScript code on the client-side. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
20.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, as a general best practice, developers can implement input validation and sanitization routines to filter out potentially malicious content. This can be done by using security libraries or frameworks that offer built-in protection against XSS attacks. It is important to thoroughly review and test the implemented solution to ensure its effectiveness.
Conclusion
The XSS vulnerability in TwitterServer's /histograms endpoint poses a moderate security risk, allowing for potential cross-site scripting attacks. To mitigate this vulnerability, it is crucial to upgrade to version 20.12.0 or later of TwitterServer and implement proper input validation and sanitization routines. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.twitter:twitter-server_2.12 →
FAQ
TwitterServer is an open-source library developed by Twitter that provides a framework for building highly scalable and robust servers in Scala. It offers various features such as request routing, service discovery, and monitoring.
The vulnerability allows for cross-site scripting (XSS) attacks, which can lead to session hijacking, data theft, and unauthorized actions on behalf of the user.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to version 20.12.0 or later of TwitterServer. Additionally, developers should implement proper input validation and sanitization routines.
There is no specific workaround provided for this vulnerability. However, developers can implement input validation and sanitization routines to mitigate the risk of XSS attacks.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
