github - ghsa-cf72-vg59-4j4h

ghsa-cf72-vg59-4j4h

Vulnerability from github

Published

2024-08-20 19:59

Modified

2024-08-21 14:53

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Summary

Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)

Details

Summary

The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS.

Details

The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS.

PoC

POST /api/automation?q=%22%3E%3C%2Ftextarea%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E

Impact

Stored XSS:

Fix

Added a Content Security Policy to all config pages on the web client, including the automation page
Used DOM scripting to construct all components on the config pages, including the automation page

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "khoj"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-43396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-20T19:59:32Z",
    "nvd_published_at": "2024-08-20T21:15:14Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. \n\n### Details\nThe `q` parameter for the `/api/automation` endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS.\n\n### PoC\n```\nPOST /api/automation?q=%22%3E%3C%2Ftextarea%3E%3Cimg%20src%3Dx%20onerror%3Dalert(document.cookie)%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E\n```\n\n### Impact\nStored XSS:\n![image](https://github.com/khoj-ai/khoj/assets/115566010/6b5b9f60-e05c-448b-82b4-bf010ad8a4f0)\n\n### Fix\n- Added a Content Security Policy to all config pages on the web client, including the automation page\n- Used DOM scripting to construct all components on the config pages, including the automation page",
  "id": "GHSA-cf72-vg59-4j4h",
  "modified": "2024-08-21T14:53:27Z",
  "published": "2024-08-20T19:59:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43396"
    },
    {
      "type": "WEB",
      "url": "https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812"
    },
    {
      "type": "WEB",
      "url": "https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/khoj-ai/khoj"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)"
}

cve-2024-43396

Vulnerability from cvelistv5

Published

2024-08-20 20:23

Modified

2024-08-21 19:52

Severity ?

5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Summary

Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.

References

▼	URL	Tags
	https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h	x_refsource_CONFIRM
	https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812	x_refsource_MISC
	https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	khoj-ai	khoj	Version: < 1.15.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43396",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-21T19:52:22.737517Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T19:52:35.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "khoj",
          "vendor": "khoj-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-20T20:23:05.660Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/khoj-ai/khoj/security/advisories/GHSA-cf72-vg59-4j4h"
        },
        {
          "name": "https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/khoj-ai/khoj/commit/1c7a562880eeb7354325545d2cf6c5d1d1134812"
        },
        {
          "name": "https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/khoj-ai/khoj/commit/55be90cdd2f9d6a09c8bf9ceea52fc36b9201626"
        }
      ],
      "source": {
        "advisory": "GHSA-cf72-vg59-4j4h",
        "discovery": "UNKNOWN"
      },
      "title": "Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43396",
    "datePublished": "2024-08-20T20:23:05.660Z",
    "dateReserved": "2024-08-12T18:02:04.965Z",
    "dateUpdated": "2024-08-21T19:52:35.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

ghsa-cf72-vg59-4j4h

Vulnerability from github

Summary

Details

PoC

Impact

Fix

cve-2024-43396

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature