Vulnerability · Published Dec 11, 2024 · Assigned by GitHub_M

CVE-2024-53274GHSL-2024-111: Reflected XSS in /home in habitica

Low 2.0

In plain English

A low-severity cross-site scripting in habatica from HabitRPG. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)2.0Low

Exploit odds (30 days)0.5%top 60.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch.

Affected products (as reported)

Vendor	Product	Versions
HabitRPG	habatica	< 5.28.5

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P

References

https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica/ x_refsource_CONFIRM
https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf x_refsource_MISC