Cross-Site Scripting Vulnerability in Namazu2 Package
Summary
CVE-2004-1318: Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents th... Affects namazu2 versions < 2.0.14-1. Fixed in 2.0.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Namazu is an open-source full-text search engine designed for indexing and searching documents. It is widely used in various applications for its efficient search capabilities. The Namazu2 package, specifically versions 2.0.13 and earlier, is vulnerable to a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts through improperly sanitized input.
Vulnerability Detail
The vulnerability, identified as CVE-2004-1318, arises from the way namazu.cgi processes user queries. When a query begins with a tab character ('%09'), the input is not sanitized correctly, allowing attackers to inject arbitrary HTML and web scripts. This can lead to unauthorized actions being performed on behalf of the user, data theft, or redirection to malicious sites. The flaw affects all versions of Namazu up to 2.0.13, making it critical for users to upgrade to a secure version.
How To Fix
Minimum fixed version
2.0.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade namazu2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, a temporary workaround is to implement input validation on the application level to sanitize user queries before they reach namazu.cgi. This can be done by stripping out any leading tab characters or other potentially harmful input. For example, you can use the following code snippet in your application:
function sanitizeInput(input) {
return input.replace(/^[\t]+/, ''); // Removes leading tab characters
}
Conclusion
The CVE-2004-1318 vulnerability in the Namazu2 package poses significant risks due to its potential for cross-site scripting attacks. Users are strongly advised to upgrade to the latest version to mitigate these risks. Implementing input validation can serve as a temporary workaround until an upgrade is possible.
See every vulnerability recorded for namazu2 →
FAQ
CVE-2004-1318 is a unique identifier for a specific vulnerability in the Namazu2 package that allows cross-site scripting attacks.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application without any signup.
The risks include unauthorized actions being performed on behalf of users, potential data theft, and exposure to malicious websites.
Yes, you can implement input validation to sanitize user queries as a temporary measure until you can upgrade.
It is recommended to upgrade to version 2.0.14-1 or later to ensure that the vulnerability is patched.
Related vulnerabilities
Recent vulnerabilities recorded for namazu2.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.