CVE-2024-29191: gotortc Cross-site Scripting vulnerability

August 5, 2024

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The links page (links.html) appends the src GET parameter ([0]) in all of its links for 1-click previews. The context in which src is being appended is innerHTML ([1]), which will insert the text as HTML. Commit 3b3d5b033aac3a019af64f83dec84f70ed2c8aba contains a patch for the issue.

References

github.com/AlexxIT/go2rtc
github.com/AlexxIT/go2rtc/commit/3b3d5b033aac3a019af64f83dec84f70ed2c8aba
github.com/advisories/GHSA-wv8x-3w6r-6h7v
nvd.nist.gov/vuln/detail/CVE-2024-29191
securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc

Code Behaviors & Features

Detect and mitigate CVE-2024-29191 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →