Exploit
CVE-2024-25639

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)

Published: Jul 8, 2024 / Updated: 4mo ago

010
CVSS 7.5EPSS 0.04%High
CVE info copied to clipboard

Summary

Khoj, an application that creates personal AI agents, has a vulnerability in its Obsidian, Desktop, and Web clients. The issue stems from inadequate sanitization of AI model responses and user inputs, which can lead to Cross Site Scripting (XSS) via Prompt Injection. This vulnerability can be triggered from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command.

Impact

The vulnerability has a CVSS v3.1 base score of 7.5, categorized as MEDIUM severity. The attack vector is network-based, requiring user interaction and high attack complexity. It can lead to high confidentiality, integrity, and availability impacts. This suggests that an attacker could potentially access sensitive information, modify data, and disrupt the system. The XSS vulnerability could allow attackers to execute malicious scripts in the context of the user's browser, potentially leading to theft of sensitive data, session hijacking, or defacement of the web interface.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability has been fixed in version 1.13.0 of Khoj.

Mitigation

1. Update Khoj to version 1.13.0 or later on all Obsidian, Desktop, and Web clients. 2. If immediate updating is not possible, consider limiting the use of the /online command and be cautious when indexing untrusted documents. 3. Implement client-side input validation and output encoding to help mitigate XSS risks. 4. Educate users about the risks of interacting with untrusted content through the Khoj application. 5. Monitor for any suspicious activities that might indicate exploitation attempts. 6. Consider implementing Content Security Policy (CSP) headers to provide an additional layer of protection against XSS attacks.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-25639

Jul 8, 2024 at 3:15 PM
First Article

Feedly found the first article mentioning CVE-2024-25639. See article

Jul 8, 2024 at 3:25 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Jul 8, 2024 at 3:26 PM
Trending

This CVE started to trend in security discussions

Jul 8, 2024 at 4:50 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.2%)

Jul 9, 2024 at 9:52 AM
Trending

This CVE stopped trending in security discussions

Jul 9, 2024 at 6:13 PM
CVSS

A CVSS base score of 7.5 has been assigned.

Oct 28, 2024 at 8:55 PM / nvd
Static CVE Timeline Graph

Affected Systems

Khoj/khoj
+null more

Exploits

https://github.com/khoj-ai/khoj/security/advisories/GHSA-h2q2-vch3-72qm
+null more

Patches

github.com
+null more

Attack Patterns

CAPEC-18: XSS Targeting Non-Script Elements
+null more

News

CVE-2024-25639 Exploit
CVE Id : CVE-2024-25639 Published Date: 2024-08-22T14:59:00+00:00 Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0. inTheWild added a link to an exploit: https://github.com/khoj-ai/khoj/security/advisories/GHSA-h2q2-vch3-72qm
Update Fri Aug 2 06:26:11 UTC 2024
Update Fri Aug 2 06:26:11 UTC 2024
NA - CVE-2024-25639 - Khoj is an application that creates personal AI...
Cvss vector : Cvss Base Score N/A Attack Range N/A Cvss Impact Score N/A Attack Complexity N/A Cvss Expoit Score N/A Authentication N/A Calculate full CVSS 2.0 Vectors scores Cvss vector : N/A Overall CVSS Score NA Base Score NA Environmental Score NA impact SubScore NA Temporal Score NA Exploitabality Sub Score NA Calculate full CVSS 3.0 Vectors scores
CVE-2024-25639
Medium Severity Description Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0. Read more at https://www.tenable.com/cve/CVE-2024-25639
Khoj Obsidian Vulnerable to Cross Site Scripting (XSS) via Prompt Injection
Khoj-ai - MEDIUM - CVE-2024-25639 Khoj is an application that creates personal AI agents. The Khoj Obsidian, Desktop and Web clients inadequately sanitize the AI model's response and user inputs. This can trigger Cross Site Scripting (XSS) via Prompt Injection from untrusted documents either indexed by the user on Khoj or read by Khoj from the internet when the user invokes the /online command. This vulnerability is fixed in 1.13.0.
See 5 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:High
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI