Wrensec Commons
Monthly
Reflected cross-site scripting in the CREST framework's HTTP binding shipped in wrensec-commons lets an unauthenticated remote attacker execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL. The HttpUtils.prepareResponse() method copied the _mimeType request parameter straight into the Content-Type response header, so a GET request carrying _mimeType=text/html makes an otherwise inert CREST JSON response be parsed and rendered as HTML, with the injected markup executing under the originating site's origin (CVSS 3.1 base 6.1, scope changed). Only deployments of the json-resource-http module below 22.6.2 or in the 23.0.0-M1 through 23.0.0 range are affected, and exploitation hinges on user interaction - the victim must open the attacker-supplied link; no public exploit code was identified at time of analysis, and patch releases 22.6.2 and 23.0.0 are available.
Reflected cross-site scripting in the CREST framework's HTTP binding shipped in wrensec-commons lets an unauthenticated remote attacker execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL. The HttpUtils.prepareResponse() method copied the _mimeType request parameter straight into the Content-Type response header, so a GET request carrying _mimeType=text/html makes an otherwise inert CREST JSON response be parsed and rendered as HTML, with the injected markup executing under the originating site's origin (CVSS 3.1 base 6.1, scope changed). Only deployments of the json-resource-http module below 22.6.2 or in the 23.0.0-M1 through 23.0.0 range are affected, and exploitation hinges on user interaction - the victim must open the attacker-supplied link; no public exploit code was identified at time of analysis, and patch releases 22.6.2 and 23.0.0 are available.