Log in Start free

Vulnerability · Published Jun 28, 2023 · Assigned by GitHub_M

CVE-2023-36474Interactsh server settings make users vulnerable to Subdomain Takeover

High 8.2

In plain English

A high-severity cross-site scripting in interactsh from projectdiscovery. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.5%top 54.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server used to create cname entries for `app` pointing to `projectdiscovery.github.io` as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/projectdiscovery/interactsh1.0.0GHSA-m36x-mgfh-8g78
Gogithub.com/projectdiscovery/interactsh1.0.0GO-2022-0372

Affected products (as reported)

VendorProductVersions
projectdiscovery interactsh < 1.0.0

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

References