Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-25926

CVE-2021-25926: Cross-site scripting in sickrage

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-25926
GHSA ID
GHSA-x823-j7c4-vpc5
EPSS Score
0.55374%
CWE
CWE-79
Published
4/20/2021
Updated
10/22/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
sickragepip>= 9.3.54, <= 10.0.11.dev110.0.11.dev2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The key evidence comes from the commit diff showing the get_argument method was modified to add bleach sanitization. Since the vulnerability stems from improper input validation in the quicksearch feature, and the framework's argument retrieval method (get_argument) is the primary input vector for web parameters, this function was the critical point of unsanitized input flow. The patch explicitly adds bleach cleaning to this central input handling method, confirming it was the vulnerability source.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In Si*KR***, v*rsions *.*.**.**v* to **.*.**.**v* *r* vuln*r**l* to R**l**t** *ross-Sit*-S*riptin* (XSS) *u* to us*r input not **in* v*li**t** prop*rly in t** `qui*ks**r**` ***tur*. T**r**or*, *n *tt**k*r **n st**l * us*r's s*ssionI* to m*squ*r*** *s

Reasoning

T** k*y *vi**n** *om*s *rom t** *ommit *i** s*owin* t** **t_*r*um*nt m*t*o* w*s mo*i*i** to *** *l**** s*nitiz*tion. Sin** t** vuln*r**ility st*ms *rom improp*r input v*li**tion in t** qui*ks**r** ***tur*, *n* t** *r*m*work's *r*um*nt r*tri*v*l m*t*o