CVE-2021-43697:Cross-Site Scripting (XSS) vulnerability in Workerman-ThinkPHP-Redis allows attackers to inject malicious scripts through the JSONP handler parameter.

splash
Back

Description Preview

A Cross-Site Scripting (XSS) vulnerability has been identified in Workerman-ThinkPHP-Redis (last updated March 16, 2018). The vulnerability exists in the Controller.class.php file, where the exit function terminates script execution and prints a message to the user. This message incorporates user-controlled input from $_GET[C('VAR_JSONP_HANDLER')], which is not properly sanitized before being displayed to users. Attackers can exploit this vulnerability by crafting malicious URLs containing JavaScript code that will be executed in the victim's browser when they visit the affected page.

Overview

The vulnerability (CVE-2021-43697) is a reflected Cross-Site Scripting (XSS) issue in Workerman-ThinkPHP-Redis, categorized as CWE-79. The framework fails to properly validate and sanitize user input from the JSONP handler parameter before including it in the response. When the exit function is called in Controller.class.php, it outputs the value of the JSONP handler parameter directly to the page. This allows attackers to inject arbitrary JavaScript code that executes in the context of the victim's browser, potentially leading to cookie theft, session hijacking, credential harvesting, or other client-side attacks.

Remediation

To remediate this vulnerability, implement the following measures:

  1. Update to a patched version of Workerman-ThinkPHP-Redis if available.
  2. If no update is available, modify the Controller.class.php file to properly sanitize the JSONP handler parameter using appropriate output encoding functions.
  3. Implement Content Security Policy (CSP) headers to help mitigate the impact of XSS attacks.
  4. Consider implementing input validation to restrict the JSONP handler parameter to only allow expected values.
  5. Apply the principle of least privilege by limiting what the application can do with user-supplied data.
  6. Regularly audit and test your code for similar security vulnerabilities.

References

  1. GitHub Issue and Advisory: https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/issues/1
  2. CWE-79 (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
  3. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Accommodation & Food Services
    Accommodation & Food Services
  2. Administrative, Support, Waste Management & Remediation Services
    Administrative, Support, Waste Management & Remediation Services
  3. Agriculture, Forestry Fishing & Hunting
    Agriculture, Forestry Fishing & Hunting
  4. Arts, Entertainment & Recreation
    Arts, Entertainment & Recreation
  5. Construction
    Construction
  6. Educational Services
    Educational Services
  7. Finance and Insurance
    Finance and Insurance
  8. Health Care & Social Assistance
    Health Care & Social Assistance
  9. Information
    Information
  10. Management of Companies & Enterprises
    Management of Companies & Enterprises
  11. Manufacturing
    Manufacturing
  12. Mining
    Mining
  13. Other Services (except Public Administration)
    Other Services (except Public Administration)
  14. Professional, Scientific, & Technical Services
    Professional, Scientific, & Technical Services
  15. Public Administration
    Public Administration
  16. Real Estate Rental & Leasing
    Real Estate Rental & Leasing
  17. Retail Trade
    Retail Trade
  18. Transportation & Warehousing
    Transportation & Warehousing
  19. Utilities
    Utilities
  20. Wholesale Trade
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background
Armis Vulnerability Intelligence Database