CVE-2021-44217: Cross-site Scripting in Ericsson CodeChecker
Summary
CVE-2021-44217: Cross-site Scripting in Ericsson CodeChecker. Affects codechecker versions < 6.18.2. Fixed in 6.18.2. How to fix ↓
Also tracked for
- codechecker-api · PyPI
The same CVE-2021-44217 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ericsson CodeChecker is a Python package available on PyPI that provides a static code analysis tool for detecting security vulnerabilities in source code. It is commonly used in software development to identify potential issues and improve code quality. However, prior to version 6.18.2, CodeChecker is susceptible to a Stored Cross-site Scripting (XSS) vulnerability in the comments component of the reports viewer. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
Vulnerability Detail
The Stored Cross-site Scripting (XSS) vulnerability in Ericsson CodeChecker arises due to insufficient input sanitization in the comments component of the reports viewer. Attackers can exploit this vulnerability by submitting malicious data through the /CodeCheckerService API, which is then stored and displayed in the reports viewer. When unsuspecting users view the affected reports, the injected script or HTML is executed in their browsers, potentially leading to unauthorized access, data theft, or other malicious activities. The vulnerability has a Moderate severity rating according to the Common Vulnerability Scoring System (CVSS) and is classified under CWE-79.
How To Fix
Minimum fixed version
6.18.2
This is the first release that contains the fix.
pip install --upgrade "codechecker==6.18.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the Stored Cross-site Scripting (XSS) vulnerability in Ericsson CodeChecker prior to version 6.18.2 poses a moderate security risk. It allows remote attackers to inject malicious scripts or HTML into the reports viewer, potentially leading to unauthorized access or data theft. To mitigate this vulnerability, it is crucial to upgrade to version 6.18.2 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codechecker →
FAQ
You can check the version of CodeChecker installed in your environment by running the command 'codechecker --version'. If the reported version is earlier than 6.18.2, your installation is vulnerable.
Yes, remote attackers can exploit this vulnerability by sending specially crafted requests to the affected /CodeCheckerService API.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
Unfortunately, there is no known workaround for this vulnerability. It is strongly recommended to upgrade to the latest version of CodeChecker as soon as possible.
You can find more information about this vulnerability in the GitHub Advisory Database at the following URL: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-fxmx-pfm2-85m2/GHSA-fxmx-pfm2-85m2.json
References
Related vulnerabilities
Recent vulnerabilities recorded for codechecker.
