Vulnerability in ArchiveBox Package: Viewing wget Extractor Output
Summary
CVE-2023-45815: Impact Any users who are using the wget or dom extractors and view the content they output. Affects archivebox versions < 0.6.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ArchiveBox is an open-source tool used for archiving web pages and creating a local, searchable HTML offline archive. It allows users to save web pages, PDFs, images, and other web content for future reference. The package provides various extractors, including the wget extractor, which retrieves web content using the wget command-line tool. However, a vulnerability has been discovered in the wget extractor output when viewed by an admin user.
Vulnerability Detail
The vulnerability arises when an admin user views the output of the wget extractor. If the archived page contains malicious JavaScript, it can execute within the admin's context, potentially leading to severe consequences. In this scenario, the malicious JavaScript can act using the admin's credentials and perform actions such as modifying snapshots, adding/removing users, and other admin-level operations. Non-logged-in users are also affected to a lesser extent, as the malicious JavaScript can read all other archived content. This issue occurs because the archived pages and the admin panel share the same host and port, bypassing typical browser security protections.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
In the meantime, there are a few workarounds you can implement:
- Disable the
wgetextractor by running the commandarchivebox config --set SAVE_WGET=False. - Ensure you are always logged out of the ArchiveBox admin site before viewing any archived pages.
- Serve only a static HTML version of your archive, which eliminates the risk of executing JavaScript.
Conclusion
The vulnerability in the ArchiveBox package's wget extractor output poses a potential security risk for admin users and, to a lesser extent, non-logged-in users. The package developers are actively working on a fix, and in the meantime, users can implement workarounds such as disabling the wget extractor or serving a static HTML version of the archive. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for archivebox →
FAQ
Any users of the ArchiveBox package who utilize the wget extractor and view its output are potentially affected. Admin users are at a higher risk due to the ability of malicious JavaScript to execute in their context.
If executed within an admin's context, the malicious JavaScript can perform actions using the admin's credentials, such as modifying snapshots and adding/removing users. For non-logged-in users, the malicious JavaScript can read all other archived content.
The ArchiveBox package developers are actively working on a patch to address this vulnerability. You can monitor the progress and find updates on the GitHub issue page.
Yes, you can disable the wget extractor by running the command archivebox config --set SAVE_WGET=False.
Yes, you can serve a static HTML version of your archive, which eliminates the risk of executing JavaScript.
References
Related vulnerabilities
Recent vulnerabilities recorded for archivebox.
