Stored XSS in seeftl package for Node.js

Published: 2020-01-06 | Updated: 2020-01-31

Risk	Low
Patch available	NO
Number of vulnerabilities	2
CVE-ID	CVE-2019-15603
CWE-ID	CWE-79
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	seeftl Web applications / Modules and components for CMS
Vendor	xiangpaopao

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

Updated: 31.01.2020

Added vulnerability #2, updated bulletin title.

1) Stored cross-site scripting

EUVDB-ID: #VU23980

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2019-15603

CWE-ID:

Exploit availability:

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when processing file names while listing directory on the server. A remote attacker can upload a specially crafted file to the server, trick the victim view directory contents, where the file malicious file is present and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

seeftl: 0.1.0 - 0.1.1

Fixed software versions

CPE2.3

cpe:2.3:a:xiangpaopao:seeftl:0.1.1:*:*:*:*:npm:*:*

External links

http://snyk.io/vuln/SNYK-JS-SEEFTL-540434
http://hackerone.com/reports/665302

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Cross-site scripting

EUVDB-ID: #VU24785