CVE-2024-5279

Vulnerability

Description A stored cross-site scripting (XSS) vulnerability exists in Qiwen Netdisk up to version 1.4.0. The issue resides in the file rename handler, where user input is not properly sanitized. An attacker can inject a malicious payload such as `` as the new filename, which will be stored and executed when other users view the file listing.

Attack

Vector The attack requires only the ability to rename a file, which is typically accessible to authenticated users. When a victim navigates to the file listing page, the crafted filename is rendered without proper encoding, causing the browser to execute the injected JavaScript. No special privileges or complex interaction are needed beyond triggering the file listing display.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session. This can lead to session cookie theft, page defacement, or redirection to malicious sites, compromising the confidentiality and integrity of user data.

Mitigation

The vulnerability has been disclosed in a public issue on the project's repository [1]. As of May 2024, no official patch has been confirmed, but users are advised to update to a fixed version if available or implement output encoding for file names to mitigate the risk.