Exploit
CVE-2024-9440

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Published: Oct 2, 2024 / Updated: 48d ago

010
CVSS 6.1EPSS 0.05%Medium
CVE info copied to clipboard

Summary

Slim Select 2.0, versions through 2.9.0, contains a potential cross-site scripting vulnerability. The issue lies in the select.ts:createOption() function, where the text variable from the user-provided Options object is assigned to an innerHTML without proper sanitation. This vulnerability affects software that depends on this library to dynamically generate lists using unsanitized user-provided input.

Impact

If exploited, this vulnerability could allow an attacker to execute malicious JavaScript code in the context of the affected web application. This can lead to various attacks such as stealing sensitive information (e.g., session tokens, cookies), manipulating the content of the web page, or performing actions on behalf of the victim user. The impact is somewhat mitigated by the fact that user interaction is required for the attack to succeed, and the confidentiality and integrity impacts are rated as low. However, the scope is changed, which means the vulnerable component impacts resources beyond its security scope.

Exploitation

One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.

Patch

At the time of reporting, no patch is available for this vulnerability. The affected versions include Slim Select 2.0 through 2.9.0.

Mitigation

While awaiting a patch, consider the following mitigation strategies: 1. Implement proper input validation and output encoding for any user-provided input that is used to dynamically generate lists with Slim Select. 2. If possible, avoid using unsanitized user input with the affected versions of Slim Select. 3. Consider implementing Content Security Policy (CSP) headers to mitigate the risk of XSS attacks. 4. Regularly monitor for updates to Slim Select and apply patches as soon as they become available. 5. If feasible, consider using an alternative library that is not affected by this vulnerability until a patch is released.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Timeline

CVE Assignment

NVD published the first details for CVE-2024-9440

Oct 2, 2024 at 7:15 PM
CVSS

A CVSS base score of 5.4 has been assigned.

Oct 2, 2024 at 7:20 PM / nvd
First Article

Feedly found the first article mentioning CVE-2024-9440. See article

Oct 2, 2024 at 7:24 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 2, 2024 at 7:24 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Oct 3, 2024 at 10:10 AM
CVSS

A CVSS base score of 6.1 has been assigned.

Nov 13, 2024 at 7:55 PM / nvd
Proof of Concept (PoC) Released

A proof of concept exploit has been released

Nov 13, 2024 at 10:10 PM
Static CVE Timeline Graph

Affected Systems

Slimselectjs/slim_select
+null more

Exploits

https://github.com/brianvoe/slim-select/issues/564
+null more

Attack Patterns

CAPEC-209: XSS Using MIME Type Mismatch
+null more

News

CVE-2024-9440 Exploit
CVE Id : CVE-2024-9440 Published Date: 2024-11-13T19:50:00+00:00 Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript. At this time, no patch is available. inTheWild added a link to an exploit: https://github.com/brianvoe/slim-select/issues/564
CVE Alert: CVE-2024-9440 - https://www. redpacketsecurity.com/cve_aler t_cve-2024-9440/ # OSINT # ThreatIntel # CyberSecurity # cve_2024_9440
CVE Alert: CVE-2024-9440
Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript.
CVE-2024-9440
Medium Severity Description Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript. At this time, no patch is available. Read more at https://www.tenable.com/cve/CVE-2024-9440
CVE-2024-9440
Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript. Gravedad 3.1 (CVSS 3.1 Base Score)
See 7 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Changed
Confidentiality:Low
Integrity:Low
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI