InvenTree up to 0.16.4 Markdown Notes Field cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in InvenTree up to 0.16.4. This issue affects some unknown processing of the component Markdown Notes Field. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2024-47610. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in InvenTree up to 0.16.4 and classified as problematic. Affected by this issue is an unknown code block of the component Markdown Notes Field. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. CVE summarizes:

InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown notes fields, which are then displayed to other logged in users who visit the same page and executed. The vulnerability has been addressed as follows: 1. HTML sanitization has been enabled in the front-end markdown rendering library - `easymde`. 2. Stored markdown is also validated on the backend, to ensure that malicious markdown is not stored in the database. These changes are available in release versions 0.16.5 and later. All users are advised to upgrade. There are no workarounds, an update is required to get the new validation functions.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-47610 since 09/27/2024. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 0.16.5 eliminates this vulnerability. Applying the patch 6e37f0cd8ba5fc527412f18f66cd6a37015fa690 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• InvenTree

Version

• 0.16.0
• 0.16.1
• 0.16.2
• 0.16.3
• 0.16.4

License

• open-source

Website

• Product: https://github.com/inventree/InvenTree/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion