High, CVSS 7.4PyPIAmendedPublished
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
CVE-2023-45815 · GHSA-cr45-98w9-gwqx
- Affected
- PyPI archivebox < 0.9.0
- Fixed in
- 0.9.0· Vendor fix available
- Issue
- Related issue & discussion: - https://github.com/ArchiveBox/ArchiveBox/issues/239 - https://github.com/ArchiveBox/ArchiveBox/wiki/Security-Overview#publishing - https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#security-concerns Impact Any users who save untrusted URLs and view the content they output. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious JS could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious JS cannot modify any archives, but it can still read all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox's archived content is served from the same host and port…
Recommended action: Upgrade to 0.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.