Executive brief
Scrypted is a home video integration and automation platform that manages connected cameras and smart home devices. A cross-site scripting vulnerability in versions 0.55.0 and earlier allows an attacker to inject malicious code via the owner and pkg parameters, potentially enabling account takeover, theft of authentication tokens, or installation of malware.
Technical details
This is a reflected cross-site scripting (CWE-79) vulnerability in the plugin-http.ts file of Scrypted. The 'owner' and 'pkg' parameters are not properly sanitized before being reflected in the response, allowing an attacker to inject arbitrary JavaScript. The vulnerability is network-accessible and requires user interaction (the victim must click a malicious link), but no authentication is needed. An attacker can execute arbitrary JavaScript in the victim's browser, stealing session cookies or authentication tokens. As of publication, no patches are available for affected versions through 0.55.0.
Affected products
- Scrypted Scrypted 0.55.0 and prior
Timeline
- 2023-12-13: disclosed: NVD publication date
- 2024-08-05: advisory: GitHub advisory published