code-projects QR Code Generator cross site scripting

Successful exploitation of CVE-2023-7149 allows an attacker to inject arbitrary JavaScript code into the context of a user's browser session. This can lead to various malicious outcomes, including session hijacking, defacement of the website, redirection to phishing sites, and theft of sensitive information like cookies and credentials. The vulnerability resides in the file download functionality, specifically the handling of the 'file' parameter. The attacker can craft a malicious URL containing a payload that, when accessed, executes the injected script. The impact is amplified if the QR Code Generator is integrated into a larger application or used to generate codes for sensitive data, as the attacker could potentially compromise the entire system.

Websites and applications that utilize the QR Code Generator component, particularly those that allow users to download files generated by the component, are at risk. Shared hosting environments where multiple users share the same server resources are also at increased risk, as a compromise of one user's QR Code Generator instance could potentially impact other users on the same server.

• php / web:

grep -r "onerror=alert(document.domain)" /var/www/html/

• generic web:

curl -I 'http://your-website.com/download.php?file=author.png%22%3EiMg%20src=N%20onerror=alert(document.domain)%3E' | grep -i 'alert(document.domain)'

1. 2023-12-29Disclosure

   disclosure

1. Gereserveerd2023-12-28
2. Gepubliceerd2023-12-29
3. Gewijzigd2024-09-09
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2023-7149 is to upgrade to version 1.0.1 of the QR Code Generator. This version includes a fix that addresses the vulnerable parameter handling. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the 'file' parameter to prevent the injection of malicious code. Additionally, implement a Web Application Firewall (WAF) with rules to detect and block requests containing suspicious characters or patterns in the 'file' parameter. Regularly review and update the QR Code Generator's codebase to identify and address potential vulnerabilities. After upgrading, confirm the fix by attempting to access the vulnerable endpoint with a malicious payload and verifying that the script is not executed.