CVE-2024-41663

A Cross-Site Scripting (XSS) vulnerability was identified in the "Cloned Website" Canarytoken, specifically affecting the slow-redirect token type. The token creator can inject JavaScript into the destination URL of their slow redirect token. When the creator later views the management page for that token, the injected JavaScript executes, resulting in a self-XSS condition [1].

An attacker can create a malicious Canarytoken with the injected JavaScript and then send the management link to a victim. When the victim clicks the link, the JavaScript runs in their browser. However, the attacker does not gain access to sensitive information such as session cookies or other credentials. This is because the XSS only executes on the token's management page, and the attacker has no means to exfiltrate the victim's session data [1].

The impact is limited to the execution of arbitrary JavaScript in the context of the victim's session on the management page. The attacker cannot escalate privileges or access other parts of the application. This vulnerability has been patched on Canarytokens.org. Users running self-hosted Canarytokens installations can update by pulling the latest Docker image (any image after sha-097d91a) [1].