CVE-2023-26131

Vulnerability

Overview

The vulnerability resides in the themes.NoPage(filename, theme) function within the Algernon web server packages github.com/xyproto/algernon/engine and github.com/xyproto/algernon/themes. Due to improper sanitization of user-supplied input, an attacker can inject arbitrary HTML and JavaScript into the response generated when a requested file or resource is not found [1][2].

Exploitation

Details

An attacker can exploit this by crafting a URL that includes a malicious payload in place of a valid resource path. For example, visiting http://localhost:3000/<img%20src=x%20onerror=alert(document.domain)%20/> triggers the NoPage function, which reflects the unsanitized input back to the user's browser [3][4]. No authentication is required, and the attack is performed over HTTP, making it accessible to any user who can send requests to the server.

Impact

Successful exploitation results in stored or reflected cross-site scripting (XSS), allowing the attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive data displayed on the page.

Mitigation

The issue is fixed in version 1.17.4 of both affected packages. Users are advised to upgrade to this version or later. No workarounds are documented; upgrading is the recommended action [3][4].