Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-2001

CVE-2024-2001:
Cockpit CMS Cross-Site Scripting vulnerability

5.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-2001
GHSA ID
GHSA-q76r-7p4q-mqpw
EPSS Score
0.20429%
CWE
CWE-79
Published
2/29/2024
Updated
2/29/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
cockpit-hq/cockpitcomposer= 2.7.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability involves XSS via malicious PDF uploads, implying improper handling of user-controlled input during file processing. The functions responsible for uploading files (e.g., Files::upload) and extracting metadata (e.g., Pdf::extractMetadata) are likely candidates. These functions may lack proper input sanitization, allowing JavaScript payloads in PDF metadata to persist and execute when rendered. Confidence is medium due to lack of direct code access, but the assessment aligns with the described attack vector and CWE-79.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *ross-Sit* S*riptin* vuln*r**ility in *o*kpit *MS *****tin* v*rsion *.*.*. T*is vuln*r**ility *oul* *llow *n *ut**nti**t** us*r to uplo** *n in***t** P** *il* *n* stor* * m*li*ious J*v*S*ript p*ylo** to ** *x**ut** w**n t** *il* is uplo****.

Reasoning

T** vuln*r**ility involv*s XSS vi* m*li*ious P** uplo**s, implyin* improp*r **n*lin* o* us*r-*ontroll** input *urin* *il* pro**ssin*. T** *un*tions r*sponsi*l* *or uplo**in* *il*s (*.*., *il*s::uplo**) *n* *xtr**tin* m*t***t* (*.*., P**::*xtr**tM*t**