Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint
Summary
In the /license/ endpoint, the detailed view key is not properly validated and sanitized, which can result in a potential cross-site scripting (XSS) vulnerability when attempting to access a detailed license view that does not exist.
Details
In the /license/ endpoint, the license_details_view function is vulnerable to a potential cross-site scripting (XSS) attack due to inadequate validation and sanitization of the key parameter. This vulnerability arises when attempting to access a key with malicious javascript.
def license_details_view(request, key):
"""
Display all available information about a given license `key` followed by
the full license text.
"""
licenses = get_licenses()
try:
data = saneyaml.dump(licenses[key].to_dict())
text = licenses[key].text
except KeyError:
return HttpResponseNotFound(f"License {key} not found.") # Leads to cross-site scripting when key is malicious javascript
return HttpResponse(f"<pre>{data}</pre><hr><pre>{text}</pre>")PoC
- Access following endpoint on scancode.io instance: http://localhost/license/%3Cscript%3Ealert(document.cookie);%3C/script%3E/
Impact
Attackers can exploit the vulnerability to inject malicious scripts into the response generated by the license_details_view function. When unsuspecting users visit the page, their browsers will execute the injected scripts, leading to unauthorized actions, session hijacking, or stealing sensitive information.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | scancodeio | < 32.5.2 | 32.5.2 |
Referencias
- https://github.com/nexB/scancode.io/security/advisories/GHSA-6xcx-gx7r-rccj
- https://nvd.nist.gov/vuln/detail/CVE-2023-40024
- https://github.com/nexB/scancode.io
- https://github.com/nexB/scancode.io/blob/dd7769fbc97c84545579cebf1dc4838214098a11/CHANGELOG.rst#v3252-2023-08-14
- https://github.com/nexB/scancode.io/releases/tag/v32.5.2
- https://pypi.org/project/scancodeio
- https://github.com/advisories/GHSA-6xcx-gx7r-rccj
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Debilidad (CWE)
CWE-79- Plataforma
- Python (PyPI)
- Paquete
scancodeio- Publicada
- 15.08.2023
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1905 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-6xcx-gx7r-rccj - CC BY 4.0
Historial de vulnerabilidades: scancodeio
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 2
- Primera → última
- 08.2023 08.2023
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Media 2
Divulgaciones por año
- 2023: 2
- 2024: 0
- 2025: 0
- 2026: 0
-
Scancode.io Reflected Cross-Site Scripting (XSS) in license endpoint esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.