CVE-2021-26722: LinkedIn Oncall Reflected XSS Vulnerability
Summary
CVE-2021-26722: LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar. Affects oncall versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LinkedIn Oncall is a package available on PyPI that provides functionality for managing on-call schedules and notifications. It allows teams to easily handle on-call rotations and escalations. The package is widely used by organizations to ensure smooth operations and effective incident response. However, a vulnerability has been discovered in versions up to 1.4.0, which could allow an attacker to execute arbitrary JavaScript code in the context of a victim's browser.
Vulnerability Detail
The vulnerability, identified as CVE-2021-26722, is a reflected cross-site scripting (XSS) vulnerability in LinkedIn Oncall. It occurs due to mishandling of the 'No results found for' message in the search bar. An attacker can craft a malicious link that, when clicked by a victim, will execute arbitrary JavaScript code in their browser. This can lead to various consequences, including session hijacking, data theft, and unauthorized actions on behalf of the victim. It is important to note that this vulnerability can only be exploited if the victim interacts with the specially crafted link.
How To Fix
Minimum fixed version
1.4.1
This is the first release that contains the fix.
pip install --upgrade "oncall==1.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the LinkedIn Oncall package to mitigate the risk of exploitation.
Conclusion
The LinkedIn Oncall package up to version 1.4.0 is vulnerable to a reflected XSS attack. It is crucial for users of this package to update to version 1.4.1 or later to mitigate the risk of exploitation. Failure to do so may result in unauthorized access, data theft, and other malicious activities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oncall →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the victim's browser, potentially leading to session hijacking, data theft, and unauthorized actions on behalf of the victim.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix to prevent potential exploitation.
The only effective mitigation is to update the LinkedIn Oncall package to version 1.4.1 or later. This will ensure that the vulnerability is patched and the application is secure.
This vulnerability was discovered by the PyPI advisory team and reported to the LinkedIn Oncall package maintainers.
