ome omero-web up to 5.25.0 callback inclusion of web functionality from an untrusted source

Summaryinfo

A vulnerability classified as critical has been found in ome omero-web up to 5.25.0. Impacted is an unknown function. This manipulation of the argument callback causes inclusion of web functionality from an untrusted source. The identification of this vulnerability is CVE-2024-35180. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in ome omero-web up to 5.25.0 and classified as critical. Affected by this vulnerability is some unknown processing. The manipulation of the argument callback with an unknown input leads to a inclusion of web functionality from an untrusted source vulnerability. The CWE definition for the vulnerability is CWE-830. The product includes web functionality (such as a web widget) from another domain, which causes it to operate within the domain of the product, potentially granting total access and control of the product to the untrusted source. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

OMERO.web provides a web based client and plugin infrastructure. There is currently no escaping or validation of the `callback` parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. This vulnerability has been patched in version 5.26.0.

The advisory is shared at github.com. This vulnerability is known as CVE-2024-35180 since 05/10/2024. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 5.26.0 eliminates this vulnerability. Applying the patch d41207cbb82afc56ea79e84db532608aa24ab4aa is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• ome

Name

• omero-web

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17
• 5.18
• 5.19
• 5.20
• 5.21
• 5.22
• 5.23
• 5.24
• 5.25.0

License

• open-source

Website

• Product: https://github.com/ome/omero-web/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion