Executive brief
cloudcmd is a web-based file manager used to manage and browse files on servers. Versions before 9.1.6 contain a cross-site scripting vulnerability in the file listing feature that allows attackers to inject malicious HTML and JavaScript by controlling file names. An attacker who can create files on the system could execute arbitrary scripts in the browsers of users viewing that directory, potentially stealing session data or manipulating files.
Technical details
This is a stored XSS vulnerability (CWE-79) in cloudcmd's file directory listing functionality. The vulnerability occurs when file names containing HTML or JavaScript are not properly sanitized before being rendered in the web interface. An attacker with the ability to create files on the system can craft a file name with embedded script tags or event handlers (e.g., "<img src=x onerror=alert('xss')>") that will execute in the browser of any user viewing that directory. The root cause is insufficient output encoding of file names displayed in the directory listing. The vulnerability affects all versions prior to 9.1.6 and was fixed in commit 23f4d47 by properly encoding HTML entities in file names. No authentication bypass is required—any user with directory browsing access is vulnerable.
Affected products
- coderaiser cloudcmd before 9.1.6
Timeline
- 2019-06-04: disclosed
- 2018-04-23: patched: Fix committed to repository; version 9.1.6 released as remediation