CVE-2022-26533: Cross-site Scripting in Alist
Summary
CVE-2022-26533: Cross-site Scripting in Alist. Affects github.com/Xhofe/alist versions >= 2.0.10, < 2.1.1. Fixed in 2.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alist is a Go package (github.com/Xhofe/alist) that provides functionality for managing lists. It is commonly used in web applications to handle data manipulation and display. Alist versions 2.0.10 through 2.1.0 are affected by a cross-site scripting (XSS) vulnerability. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by users of applications that use Alist. The issue was addressed in version 2.1.1.
Vulnerability Detail
The cross-site scripting (XSS) vulnerability in Alist versions 2.0.10 through 2.1.0 is caused by improper input sanitization. Specifically, the vulnerability exists in the handling of the /i/:data/ipa.plist endpoint. An attacker can exploit this vulnerability by injecting malicious scripts into the data parameter of the URL. When a user views a page that includes the vulnerable endpoint, the injected scripts will be executed in the context of the user's browser, potentially leading to unauthorized actions or data theft. The vulnerability has a CVSS score of 6.1, indicating a moderate severity.
How To Fix
Minimum fixed version
2.1.1
This is the first release that contains the fix.
go get github.com/Xhofe/alist@v2.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of Alist is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the input received from the /i/:data/ipa.plist endpoint. This can be done by validating and filtering the data parameter to remove any potentially malicious scripts. Here is an example of how to sanitize the input in Go:
import (
"github.com/Xhofe/alist"
"html"
"net/http"
)
func handleIPA(w http.ResponseWriter, r *http.Request) {
data := r.URL.Query().Get("data")
cleanData := html.EscapeString(data)
// Use the sanitized data
}
Conclusion
The cross-site scripting vulnerability in Alist versions 2.0.10 through 2.1.0 can be exploited by injecting malicious scripts into the /i/:data/ipa.plist endpoint. To mitigate this vulnerability, it is recommended to upgrade to Alist version 2.1.1 or later. If immediate upgrade is not possible, developers should manually sanitize the input received from the vulnerable endpoint. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/Xhofe/alist →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of a user's browser. This can lead to various malicious activities, such as stealing sensitive information, performing unauthorized actions on behalf of the user, or manipulating the content of the affected web pages.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide the URL of your application and the playground will analyze it for known vulnerabilities, including CVE-2022-26533.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity. The score is based on the potential impact and exploitability of the vulnerability.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to address the vulnerability promptly to prevent potential exploitation.
You can find more information about the fix in the Alist repository on GitHub. The fix was implemented in version 2.1.1, and the release notes or commit history may provide additional details on the specific changes made to address the vulnerability.
