CVE-2024-39162

Advisory

Affected versions of Pyspider are vulnerable to Reflected Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF). These issues allow attackers to execute arbitrary code on the host by exploiting unsanitized input in the /update endpoint and leveraging Basic HTTP Authentication without CSRF protection. An attacker can manipulate authenticated users into visiting a malicious site, leading to code execution. To mitigate, disable the WebUI or implement proper input sanitization and CSRF tokens

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://docs.pyspider.org/en/latest/
• https://www.sonarsource.com/blog/basic-http-authentication-risk-uncovering-pyspider-vulnerabilities/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39162