CVE-2024-6449 is categorized under the Common Weakness Enumeration (CWE) as a “permissive policy between domains with untrusted domains” (CWE-942). The vulnerability arises from the software’s failure to restrict cross-domain requests when retrieving remote content specified by a GET request parameter. This oversight allows an unauthenticated remote attacker to create malicious links that, when clicked, load and execute scripts from a remote server controlled by the attacker within the user’s context. Additionally, the attacker can manipulate the GET parameter to potentially enumerate devices on the local area network where the server resides.
The second vulnerability, CVE-2024-6450, is classified as inadequate input neutralization during web page generation, also known as Cross-Site Scripting (XSS) (CWE-79). In this scenario, an unauthenticated attacker could trick a user into clicking on a manipulated URL, resulting in the execution of scripts within the user’s browser. This type of vulnerability can be exploited to perform various malicious actions, including data theft or unauthorized access to sensitive information.
Both vulnerabilities raise significant security concerns, particularly because all affected versions of the HyperView Geoportal Toolkit prior to 8.5.0 remain susceptible to these attacks. The vulnerabilities highlight the importance of implementing robust security measures to mitigate risks associated with cross-domain requests and to ensure proper validation of user inputs to prevent XSS attacks.
CERT Polska expressed gratitude to Dariusz Gońda for responsibly reporting the vulnerabilities, underscoring the role of coordinated disclosure in improving software security. For further details regarding the coordinated vulnerability disclosure process, additional resources are available on the CERT Polska website.
Organizations using the HyperView Geoportal Toolkit are strongly advised to update to version 8.5.0 or later promptly to protect against these vulnerabilities and enhance the overall security posture of their systems.
Enlace de la fuente, haz clic para tener más información