Reflected XSS vulnerability in keter
Summary
HSEC-2024-0001: Reflected XSS vulnerability in keter. Affects keter versions >= 0.3.4, < 1.8.4. Fixed in 1.8.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keter is an app-server/reverse-proxy often used with webapps built on the Yesod web-framework. It provides functionality for hosting and managing web applications. The vulnerability in Keter allows for a reflected cross-site scripting (XSS) attack.
Vulnerability Detail
In the logic handling VHost dispatch, Keter was echoing back the Host header value, unescaped, as part of an HTML error page. This allows an attacker to inject malicious code into the page, potentially leading to the execution of arbitrary scripts in the context of the user's browser. While this vulnerability may not be directly exploitable from a browser, it can become exploitable if there are other weaknesses in components upstream of Keter in the HTTP proxying chain. The severity of this vulnerability is rated as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N).
How To Fix
Minimum fixed version
1.8.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of Keter.
Conclusion
The reflected XSS vulnerability in Keter can allow an attacker to inject malicious code into a website, potentially leading to the execution of arbitrary scripts in the context of the user's browser. It is important to upgrade to the fixed version of Keter (1.8.4 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for keter →
FAQ
Keter is an app-server/reverse-proxy used with webapps built on the Yesod web-framework. It provides functionality for hosting and managing web applications.
A reflected XSS vulnerability allows an attacker to inject malicious code into a website, which is then executed by the victim's browser. In this case, the vulnerability in Keter allows for the injection of malicious code through the Host header value.
While this vulnerability may not be directly exploitable from a browser, it can become exploitable if there are other weaknesses in components upstream of Keter in the HTTP proxying chain. An attacker could potentially manipulate the Host header value to inject malicious code and execute arbitrary scripts in the context of the user's browser.
The severity of this vulnerability is rated as High (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). This indicates a high level of exploitability and potential impact.
To fix this vulnerability, it is recommended to upgrade to Keter version 1.8.4 or later. This version includes a fix for the reflected XSS vulnerability.
