PyPI: confidant
CVE-2024-45793
Safety vulnerability ID: SFTY-20240920-57142
Safety legacy ID: pyup.io-73295
Confidant affected versions contain a critical Cross-Site Scripting (XSS) vulnerability affecting multiple API endpoints for credential and service operations. This stored XSS flaw enables authenticated attackers with credential creation privileges to inject malicious scripts, potentially compromising other users' sessions, stealing sensitive information, or executing unauthorized actions. Inadequate input sanitization and improper content-type headers in API responses cause this vulnerability. Developers have patched the issue by implementing robust XSS protection measures, including security headers and proper content-type settings for API responses.
Overview
Prevent XSS from Confidant API call
Advisory
Confidant affected versions contain a critical Cross-Site Scripting (XSS) vulnerability affecting multiple API endpoints for credential and service operations. This stored XSS flaw enables authenticated attackers with credential creation privileges to inject malicious scripts, potentially compromising other users' sessions, stealing sensitive information, or executing unauthorized actions. Inadequate input sanitization and improper content-type headers in API responses cause this vulnerability. Developers have patched the issue by implementing robust XSS protection measures, including security headers and proper content-type settings for API responses.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20240920-57142/CVE-2024-45793
- https://github.com/lyft/confidant/security/advisories/GHSA-rxq8-q85f-m866
- https://github.com/lyft/confidant/commit/8876b07abde0c8d2a4974f79b60562b6d0193db9
- https://nvd.nist.gov/vuln/detail/CVE-2024-45793
- https://hackerone.com/reports/2332004
- https://hackerone.com/reports/2456673
- https://hackerone.com/reports/2476542
- https://github.com/advisories/GHSA-rxq8-q85f-m866
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more