EUVD-2026-40359
GHSA-7cpf-frp7-pm75
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered JSONP attack requires victim browser network access (AV:N) and visiting attacker page (UI:R, AC:H); no auth on endpoints (PR:N); only cluster metadata confidentiality impact (C:L), no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SeaweedFS before 4.30 reflects the callback query parameter verbatim into responses served with Content-Type application/javascript in the shared writeJson helper (weed/server/common.go), with no callback-name validation, no X-Content-Type-Options: nosniff header, and no CORS allow-list. Every JSON endpoint that uses writeJson - including the unauthenticated master endpoints /dir/status, /dir/lookup and /cluster/status, the volume server /status, and the filer directory listing, all reachable in the default configuration (no -whiteList, no security.toml, bound to 0.0.0.0) - can therefore be loaded cross-origin via a script tag with a chosen callback, letting a third-party web page read cluster topology, volume server URLs and gRPC ports, file identifiers, and directory listings. Because the callback string is reflected at the start of the body and no nosniff header is sent, MIME-sniffing clients may also interpret the reflected content as HTML.
AnalysisAI
Unvalidated JSONP callback reflection in SeaweedFS before 4.30 enables cross-origin reads of cluster topology, volume server URLs, gRPC ports, file identifiers, and directory listings from unauthenticated endpoints reachable in the default deployment configuration. The shared writeJson helper in weed/server/common.go concatenates the callback query parameter verbatim into application/javascript responses with no allowlist validation, no X-Content-Type-Options: nosniff header, and no CORS policy, allowing attacker-controlled pages to load these endpoints via script tags and receive cluster metadata through the injected callback. A public proof-of-concept exists; the vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.3 reflects constrained direct impact due to required user interaction and high attack complexity, though the leaked reconnaissance data elevates chained-attack risk.
Technical ContextAI
SeaweedFS is an open-source distributed blob store and file system written in Go (CPE: cpe:2.3:a:seaweedfs:seaweedfs:*:*:*:*:*:*:*:*). The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting), specifically in the JSONP pattern implemented by the writeJson shared helper. JSONP is a legacy cross-origin data-sharing technique where a server wraps its JSON payload in a caller-supplied JavaScript function name; modern deployments replace it with CORS, but SeaweedFS implements JSONP without any of the security controls that make it safe: no regex or allowlist validation of the callback name, no X-Content-Type-Options: nosniff header to prevent MIME confusion, and no CORS allowlist. Every JSON-emitting endpoint calls this helper, exposing the master server (/dir/status, /dir/lookup, /cluster/status), the volume server (/status), and the filer directory listing. Because the default configuration binds to 0.0.0.0 with no -whiteList flag and no security.toml, all these endpoints are reachable without authentication. The absence of nosniff also means MIME-sniffing browsers may interpret the reflected callback string as HTML, broadening the potential toward reflected XSS.
RemediationAI
The primary fix is to upgrade SeaweedFS to version 4.30 or later; the patch was introduced via commit 77dcb20a7485074d37340985d53103f94538abe6 (PR #9686, release at https://github.com/seaweedfs/seaweedfs/releases/tag/4.30) and adds callback-name validation and the missing X-Content-Type-Options: nosniff header to writeJson. For deployments that cannot upgrade immediately, the most effective compensating control is to deploy a reverse proxy (e.g., nginx) in front of the master, volume, and filer ports that strips the callback query parameter from all incoming requests - this eliminates the JSONP vector entirely while preserving normal JSON operation, with the trade-off that any legitimate JSONP consumers in the environment will break. Alternatively, launching SeaweedFS with the -whiteList flag to restrict allowed client IP ranges or binding the service to a loopback or private interface instead of 0.0.0.0 prevents untrusted browsers from reaching the endpoints cross-origin. Adding X-Content-Type-Options: nosniff at the reverse-proxy layer as a response header mitigates the MIME-sniffing XSS variant independently. Network-layer controls (firewall rules blocking public access to SeaweedFS ports 9333 and 8080) also reduce attack surface with no application-level side effects.
Server-side request forgery with response read-back in SeaweedFS distributed storage (versions prior to 4.24) lets anyon
Cross-tenant authorization bypass in SeaweedFS filer JWT path authorization allows any authenticated tenant to read and
Cross-bucket read/write in SeaweedFS before 4.30 lets remote attackers escape a bucket's namespace because the S3 API ga
Cross-tenant object deletion in SeaweedFS before 4.34 lets an authenticated S3 principal holding write access to just on
Authentication bypass in SeaweedFS filer before 4.24 exposes the SeaweedIdentityAccessManagement gRPC service without an
Authorization bypass in SeaweedFS versions 4.39 and earlier allows authenticated federated users to assume IAM roles the
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operati
Incorrect authorization in SeaweedFS S3 API's PutObjectAcl handler allows an authenticated low-privilege S3 principal to
seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstract_sql/abstract_sql_sto
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today