CVE-2024-32484
📋 TL;DR
A reflected cross-site scripting (XSS) vulnerability in Anki's Flask server allows attackers to execute arbitrary JavaScript by tricking users into opening malicious flashcards. This can lead to arbitrary file reads on the victim's system. Users of Anki 24.04 who open shared flashcards are affected.
💻 Affected Systems
- Ankitects Anki
📦 What is this software?
Anki by Ankitects
⚠️ Risk & Real-World Impact
Worst Case
Attacker reads sensitive files from user's system, steals session cookies, and performs actions as the user.
Likely Case
Attacker steals session cookies to hijack accounts or reads local files containing personal data.
If Mitigated
Limited impact if user doesn't open untrusted flashcards or has strong browser security settings.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious flashcard). Technical details and PoC are publicly available in Talos reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.05 or later
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2024-1995
Restart Required: Yes
Instructions:
1. Update Anki to version 24.05 or later. 2. Restart the application. 3. Verify the update by checking the version in About Anki.
🔧 Temporary Workarounds
Disable Flashcard Sharing
allPrevent users from opening shared flashcards from untrusted sources.
Use Browser Security Extensions
allDeploy browser extensions that block reflected XSS attacks.
🧯 If You Can't Patch
- Restrict flashcard sharing to trusted sources only.
- Educate users about the risks of opening untrusted flashcards.
🔍 How to Verify
Check if Vulnerable:
Check if Anki version is 24.04. If yes, it is vulnerable.Check Version:
On Anki: Help > About. On command line: anki --versionVerify Fix Applied:
Verify Anki version is 24.05 or later.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to invalid paths in Flask server logs
- JavaScript execution in unexpected contexts
Network Indicators:
- HTTP requests containing malicious JavaScript payloads in flashcard data
SIEM Query:
source="anki_logs" AND (path="*invalid*" OR message="*JavaScript*" OR status=404)