#VU49161 Cross-site scripting in Cherokee webserver - CVE-2019-20798

Vulnerability identifier: #VU49161

Vulnerability risk: Medium

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Green]

CVE-ID: CVE-2019-20798

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cherokee webserver
Server applications / Web servers

Vendor: Cherokee-project

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists in handler_server_info.c due to insufficient sanitization of user-supplied data passed to the About page in the default configuration of the web server and its administrator panel. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Example:

http://[host]/about/"><script>alert(1)</script>
http://[host]:9090/about/"><script>alert(1)</script>

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Cherokee webserver: 1.0.12 - 1.2.104

---

External links
https://github.com/cherokee/webserver/issues/1227
https://logicaltrust.net/blog/2019/11/cherokee.html
https://security.gentoo.org/glsa/202012-09

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.