-
Notifications
You must be signed in to change notification settings - Fork 22
/
index.html
64 lines (64 loc) · 2.98 KB
/
index.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
---
layout: security-advisory
filename: security
title: CVE-2024-35180 ("JSONP callback")
main-blurb: Affects OMERO.web <=5.25.0
---
<!-- begin SecVul -->
<hr class="whitespace">
<div class="secvul-row row">
<div class="small-12 medium-3 columns">
<h3 class="secvul-heading"><i class="fa fa-th-list"></i> Synopsis</h3>
</div>
<div class="small-12 medium-9 columns">
<p class="secvul-description">Check that the JSONP callback is a valid function</p>
</div>
</div>
<div class="secvul-row row">
<div class="small-12 medium-3 columns">
<h3 class="secvul-heading"><i class="fa fa-history"></i> Background</h3>
</div>
<div class="small-12 medium-9 columns">
<p class="secvul-description">
There is currently no escaping or validation of the <code>callback</code> parameter that can be passed to various OMERO.web endpoints that have JSONP enabled. One such endpoint is <code>/webclient/imgData/...</code>. As we only really use these endpoints with <a href="https://learn.jquery.com/ajax/working-with-jsonp/">jQuery's own callback name generation</a> it is quite difficult or even impossible to exploit this in vanilla OMERO.web. However, these metadata endpoints are likely to be used by many plugins.
</p>
</div>
</div>
<div class="secvul-row row">
<div class="small-12 medium-3 columns">
<h3 class="secvul-heading"><i class="fa fa-archive"></i> Affected Packages</h3>
</div>
<div class="small-12 medium-9 columns">
<p class="secvul-description">OMERO.web <=5.25.0</p>
</div>
</div>
<div class="secvul-row row">
<div class="small-12 medium-3 columns">
<h3 class="secvul-heading"><i class="fa fa-exclamation-triangle"></i> Impact</h3>
</div>
<div class="small-12 medium-9 columns">
<p class="secvul-description">Moderate severity.</p>
</div>
</div>
<div class="secvul-row row">
<div class="small-12 medium-3 columns">
<h3 class="secvul-heading"><i class="fa fa-lightbulb-o"></i> Workaround</h3>
</div>
<div class="small-12 medium-9 columns">
<p class="secvul-description">
None.
</p>
</div>
</div>
<div class="secvul-row row">
<div class="small-12 medium-3 columns">
<h3 class="secvul-heading"><i class="fa fa-check"></i> Resolution</h3>
</div>
<div class="small-12 medium-9 columns">
<p class="secvul-description">
All OMERO.web deployments should be upgraded to at least 5.26.0.
</p>
</div>
</div>
<!-- end SecVul -->
<hr class="whitespace">