CVE-2023-36474: falha de alta gravidade em projectdiscovery interactsh
Interactsh server settings make users vulnerable to Subdomain Takeover
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N
Produtos afetados
projectdiscovery · interactshReferências
https://github.com/projectdiscovery/interactsh/issues/136https://github.com/projectdiscovery/interactsh/pull/155https://github.com/projectdiscovery/interactsh/security/advisories/GHSA-m36x-mgfh-8g78https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/