CVE-2023-7149: XSS in QR Code Generator 1.0

Successful exploitation of CVE-2023-7149 allows an attacker to inject arbitrary JavaScript code into the context of a user's browser session. This can lead to various malicious outcomes, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive information like cookies and credentials. The vulnerability resides in the file download functionality, specifically the handling of the 'file' parameter. The attacker can craft a malicious URL containing a payload that, when accessed, executes the injected script. The impact is amplified if the QR Code Generator is integrated into a larger application or used to generate codes for sensitive data, as the attacker could potentially compromise the entire system.

1. Reserved2023-12-28
2. Published2023-12-29
3. Modified2024-09-09
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-7149 is to upgrade to version 1.0.1 of the QR Code Generator. This version includes a fix that addresses the vulnerable parameter handling. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the 'file' parameter to prevent the injection of malicious code. Additionally, implement a Web Application Firewall (WAF) with rules to detect and block requests containing suspicious characters or patterns in the 'file' parameter. Regularly review and update the QR Code Generator's codebase to identify and address potential vulnerabilities. After upgrading, confirm the fix by attempting to access the vulnerable endpoint with a malicious payload and verifying that the script is not executed.