CVE-2015-4706

IPython 3.x < 3.2 XSS in /api/contents

• CVSS 6.1
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Configuration Issues
• Remote

Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.

CVE

CVE-2015-4706

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

6.1

Published

2017-09-21

OWASP

A03 Injection

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Configuration Issues

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to IPython version 3.2 or higher

from flask import Flask, jsonify, request

app = Flask(__name__)

@app.route('/api/contents', methods=['POST'])
def contents():
    error_message = request.json.get('error_message', '')

    response = {
        'status': 'error',
        'message': error_message
    }
    return jsonify(response)

if __name__ == '__main__':
    app.run()

from flask import Flask, jsonify, request, escape

app = Flask(__name__)

@app.route('/api/contents', methods=['POST'])
def contents():
    error_message = request.json.get('error_message', '')

    escaped_error_message = escape(error_message)

    response = {
        'status': 'error',
        'message': escaped_error_message
    }
    return jsonify(response)

if __name__ == '__main__':
    app.run()

@misc{vaitp:cve20154706,
  title        = {{IPython 3.x < 3.2 XSS in /api/contents}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2015-4706},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2015-4706/}}
}