CVE-2024-25712: http-swagger XSS via PUT requests
(updated )
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.
References
- cosmosofcyberspace.github.io/improper_http_method_leads_to_xss/poc.html
- github.com/advisories/GHSA-49w7-5r33-jm9m
- github.com/swaggo/http-swagger
- github.com/swaggo/http-swagger/commit/b7d83e8fba85a7a51aa7e45e8244b4173f15049e
- github.com/swaggo/http-swagger/pull/62
- github.com/swaggo/http-swagger/releases/tag/v1.2.6
- nvd.nist.gov/vuln/detail/CVE-2024-25712
Code Behaviors & Features
Detect and mitigate CVE-2024-25712 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →