Cross-Site Scripting Vulnerability in Namazu2 Package
Summary
DEBIAN-CVE-2004-1318: Cross-site scripting (XSS) vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab ("%09") character, which prevents th... Affects namazu2 versions < 2.0.14-1. Fixed in 2.0.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Namazu2 is a full-text search engine designed for web applications, allowing users to search through documents and data efficiently. It is widely used in various Debian distributions for its simplicity and effectiveness. However, versions 2.0.13 and earlier are vulnerable to a cross-site scripting (XSS) issue that can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from improper sanitization of user input in the namazu.cgi script. Specifically, when a query begins with a tab character ('%09'), the script fails to sanitize the remainder of the input, allowing attackers to inject arbitrary HTML and web scripts. This can lead to unauthorized actions being performed on behalf of users, data theft, or defacement of web pages. The vulnerability is classified as CVE-2004-1318 and affects all versions prior to 2.0.14.
How To Fix
Minimum fixed version
2.0.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade namazu2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation on the client-side to prevent the submission of queries that start with a tab character. However, this does not replace the need for an official patch.
Conclusion
The cross-site scripting vulnerability in Namazu2 poses significant risks to users and applications utilizing this package. It is crucial to update to the latest version to ensure security. Additionally, users can leverage tools like Vulert to monitor and alert for open-source vulnerabilities in their software.
See every vulnerability recorded for namazu2 →
FAQ
The vulnerability is a cross-site scripting (XSS) issue that allows attackers to inject malicious scripts via specially crafted queries.
Versions 2.0.13 and earlier are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and defacement of web pages.
Yes, updating to version 2.0.14-1 or later of the Namazu2 package provides a permanent fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for namazu2.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.