Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-49277

CVE-2023-49277:
Reflected XSS Vulnerability in dpaste

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-49277
GHSA ID
GHSA-r8j9-5cj7-cv39
EPSS Score
0.64407%
CWE
CWE-79
Published
12/1/2023
Updated
12/7/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
Dpastepip< 3.83.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper output encoding in error responses generated by the API endpoint. The commit diff shows two critical changes: 1) Added HTML escaping for the 'lexer' parameter in syntax validation error messages 2) Added HTML escaping for the 'expires' parameter in expiration validation error messages. Both parameters were previously inserted into responses without proper sanitization using standard Django escaping (django.utils.html.escape). The vulnerable code paths reside in the post method handler that processes user submissions, specifically in the parameter validation sections that return error responses containing reflected user input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * s**urity vuln*r**ility **s ***n i**nti*i** in t** *xpir*s p*r*m*t*r o* t** *p*st* *PI, *llowin* *or * POST R**l**t** XSS *tt**k. T*is vuln*r**ility **n ** *xploit** *y *n *tt**k*r to *x**ut* *r*itr*ry J*v*S*ript *o** in t** *ont*xt o* *

Reasoning

T** vuln*r**ility st*ms *rom improp*r output *n*o*in* in *rror r*spons*s **n*r*t** *y t** *PI *n*point. T** *ommit *i** s*ows two *riti**l ***n**s: *) ***** *TML *s**pin* *or t** 'l*x*r' p*r*m*t*r in synt*x v*li**tion *rror m*ss***s *) ***** *TML *s*