Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-4315

CVE-2021-4315: NYUCCL psiTurk IS vulnerable to Improper Neutralization of Special Elements

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-4315
GHSA ID
GHSA-9mq4-9556-6qxq
EPSS Score
0.23926%
CWE
CWE-94
Published
1/29/2023
Updated
10/18/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
psiTurkpip< 3.2.13.2.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from three connected functions:

  1. advertisement() and give_consent() handled HTTP requests and passed user-controlled 'mode' parameters
  2. These functions called insert_mode() which performed unsafe string insertion of the mode value
  3. The final render_template_string() call processed the modified template with raw user input

Pre-patch code showed direct concatenation of mode parameter into template HTML (e.g., '&mode=' + mode), allowing template engine code injection. The patch replaced this with proper template variable syntax ({{ mode }}) and moved parameter passing to the safe render_template_string context.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility **s ***n *oun* in NYU**L psiTurk up to *.*.* *n* *l*ssi*i** *s *riti**l. T*is vuln*r**ility *****ts unknown *o** o* t** *il* psiturk/*xp*rim*nt.py. T** m*nipul*tion o* t** *r*um*nt mo** l***s to improp*r n*utr*liz*tion o* sp**i*l *l*m

Reasoning

T** vuln*r**ility st*ms *rom t*r** *onn**t** *un*tions: *. **v*rtis*m*nt() *n* *iv*_*ons*nt() **n*l** *TTP r*qu*sts *n* p*ss** us*r-*ontroll** 'mo**' p*r*m*t*rs *. T**s* *un*tions **ll** ins*rt_mo**() w*i** p*r*orm** uns*** strin* ins*rtion o* t** mo