Executive brief
Shout, a web-based IRC (Internet Relay Chat) client, contains a vulnerability that allows attackers to inject malicious code into the chat interface. By using a specific command to set a channel topic, an attacker can execute scripts in the browsers of other users viewing that channel. This could lead to unauthorized actions being performed on behalf of users or the theft of sensitive session information.
Technical details
Shout versions 0.44.0 through 0.49.3 are vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input in the /topic command. The application fails to escape HTML entities when processing and displaying channel topics to users. A remote attacker can exploit this by setting a channel topic containing malicious script tags or HTML elements. When other users view the affected channel, the injected payload executes in the context of their browser session. This vulnerability is classified as CWE-80 (Basic XSS). A fix is available in version 0.50.0, which implements proper escaping of the topic string.
Affected products
- erming shout >= 0.44.0, <= 0.49.3
Timeline
- 2015-01-22: patched: Fix merged in GitHub pull request #344
- 2018-06-04: disclosed: NVD published date
- 2018-11-07: advisory: GitHub Advisory published