CVE-2023-49277
📋 TL;DR
This vulnerability in dpaste allows attackers to execute arbitrary JavaScript in users' browsers via a reflected XSS attack through the expires parameter in the API. It affects all dpaste installations running versions older than v3.8. Successful exploitation could lead to session hijacking, data theft, or unauthorized actions.
💻 Affected Systems
- dpaste
📦 What is this software?
Dpaste by Darrennathanael
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals admin session cookies, takes over the dpaste instance, accesses all pasted data, and potentially compromises the underlying server.
Likely Case
Attacker steals user session cookies to access private pastes or performs phishing attacks by injecting malicious content.
If Mitigated
With proper CSP headers and input validation, impact is limited to temporary UI disruption.
🎯 Exploit Status
Reflected XSS vulnerabilities are commonly weaponized. No public PoC found but exploitation is straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.8
Vendor Advisory: https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39
Restart Required: Yes
Instructions:
1. Backup your dpaste data and configuration. 2. Stop the dpaste service. 3. Update dpaste to v3.8 or later using pip: 'pip install --upgrade dpaste'. 4. Restart the dpaste service.
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules.
- Add Content Security Policy (CSP) headers to restrict script execution.
🔍 How to Verify
Check if Vulnerable:
Check dpaste version: 'dpaste --version' or examine package metadata. If version is below 3.8, it's vulnerable.Check Version:
dpaste --versionVerify Fix Applied:
Confirm version is 3.8 or higher: 'dpaste --version' should show 3.8+. Test API endpoints with XSS payloads in expires parameter to ensure they're sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to API endpoints with JavaScript in expires parameter
- Multiple failed XSS attempts in access logs
Network Indicators:
- HTTP requests containing script tags or JavaScript in expires parameter
- Unusual outbound connections after API calls
SIEM Query:
source="dpaste_logs" AND (http_method="POST" AND uri_path="/api/" AND query_string="*expires=*<script*" OR query_string="*expires=*javascript:*")🔗 References
- https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086
- https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39
- https://github.com/DarrenOfficial/dpaste/commit/44a666a79b3b29ed4f340600bfcf55113bfb7086
- https://github.com/DarrenOfficial/dpaste/security/advisories/GHSA-r8j9-5cj7-cv39
