CVE-2023-48199
📋 TL;DR
This HTML injection vulnerability in Grocy's API key management component allows attackers to inject arbitrary HTML content into QR code detail popups. While script execution is prevented, attackers can manipulate page appearance to deceive users through social engineering. All Grocy instances running version 4.0.3 or earlier are affected.
💻 Affected Systems
- Grocy
📦 What is this software?
Grocy by Grocy Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create convincing phishing interfaces within the legitimate application, potentially tricking users into revealing credentials or performing unauthorized actions.
Likely Case
Attackers inject misleading HTML content to manipulate QR code displays, potentially redirecting users to malicious sites or displaying false information.
If Mitigated
With proper input sanitization, HTML injection is prevented, maintaining the integrity of QR code displays and preventing content manipulation.
🎯 Exploit Status
Exploitation requires access to the API key management interface and knowledge of the vulnerable parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 4.0.3
Vendor Advisory: https://github.com/grocy/grocy
Restart Required: Yes
Instructions:
1. Backup your Grocy instance and database. 2. Update Grocy to version 4.0.4 or later. 3. Restart the Grocy service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Input Sanitization Filter
allImplement server-side HTML entity encoding for all user inputs in the manageApiKeys component
Access Restriction
allRestrict access to the API key management interface to trusted administrators only
🧯 If You Can't Patch
- Implement web application firewall rules to block HTML injection patterns in API key parameters
- Disable or restrict the manageApiKeys component if not essential for operations
🔍 How to Verify
Check if Vulnerable:
Check Grocy version in web interface or via package manager. If version is 4.0.3 or earlier, you are vulnerable.Check Version:
Check Grocy web interface settings or consult package manager (e.g., 'apt list --installed | grep grocy' on Debian-based systems)Verify Fix Applied:
After updating, verify version is 4.0.4 or later and test that HTML injection attempts in API key parameters are properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual HTML tags or attributes in API key parameter values
- Multiple failed injection attempts in manageApiKeys logs
Network Indicators:
- HTTP requests containing HTML tags in manageApiKeys parameter values
SIEM Query:
source="grocy_logs" AND ("manageApiKeys" AND ("<script" OR "<img" OR "<iframe" OR "onerror="))