CVE-2024-47067: Alist reflected Cross-Site Scripting vulnerability

October 10, 2024

AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.

References

github.com/advisories/GHSA-8pph-gfhp-w226
github.com/alist-org/alist
github.com/alist-org/alist/commit/6100647310594868e931f3de1188ddd8bde93b78
nvd.nist.gov/vuln/detail/CVE-2024-47067
securitylab.github.com/advisories/GHSL-2023-220_Alist

Code Behaviors & Features

Detect and mitigate CVE-2024-47067 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →