JavaScript Injection Vulnerability in Stirling-PDF by Stirling Tools
CVE-2024-52286

2LOW

Key Information:

Vendor

Stirling-tools

Status
Stirling-PDF
Vendor
CVE Published:
11 November 2024

What is CVE-2024-52286?

The Stirling-PDF application contains a vulnerability that permits an attacker to exploit the Merge functionality by uploading files with names that contain HTML tags. This results in the potential execution of arbitrary JavaScript code in the user’s context. The vulnerability arises due to the lack of sanitization on user-supplied file names, specifically at Line 24 of merge.js, where InnerHTML is directly manipulated. Users can be manipulated into executing this code through social engineering tactics, which may lead to phishing attacks. The developers have remedied the issue in version 0.32.0, and all users are strongly encouraged to update their applications to safeguard against exploitation. Currently, there are no workarounds for this vulnerability.

Affected Version(s)

Stirling-PDF < 0.32.0

References

https://github.com/Stirling-Tools/Stirling-PDF/security/a...
x_refsource_CONFIRM
https://github.com/Stirling-Tools/Stirling-PDF/commit/404...
x_refsource_MISC

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

.