CVE-2024-51498

Vulnerability

Description Cobalt, a media downloader, contained a cross-site scripting (XSS) vulnerability in the picker dialog. A malicious cobalt instance could serve a download link using the javascript: protocol. When the user clicks to download an item from the picker, the application would call window.open() with that malicious URL, executing attacker-controlled JavaScript in the context of the victim's browser. This issue was introduced in commit 66bac03e, which added the picker dialog [2].

Exploitation

Conditions An attacker must operate or control a cobalt instance that the victim uses. If the victim attempts to download a media item via the picker, the malicious instance returns a link with the javascript: protocol. There is no requirement for authentication beyond the user voluntarily using the malicious service. The attack vector is network-based with low complexity [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the user's browser. This could lead to theft of session tokens, credentials, or other sensitive data, as well as performing actions on behalf of the user within the context of the cobalt web application.

Mitigation

The vulnerability was partially mitigated in commit 97977efa by adding a Content-Security-Policy header that restricted script sources, protecting correctly configured instances [3]. The definitive fix was implemented in commit c4be1d3a, which validates that the URL protocol is http: or https: before opening, preventing arbitrary protocol execution [4]. This fix is included in release version 10.2.1. Users are advised to upgrade. Those unable to upgrade should enable a Content-Security-Policy to restrict script execution.