Executive brief
Scrypted, a home automation platform, contains two reflected cross-site scripting (XSS) vulnerabilities in its web interface that could allow attackers to trick users into running malicious code. If an attacker crafts a malicious link and tricks an administrator into clicking it, they could potentially execute arbitrary commands on the system, leading to complete system compromise.
Technical details
Two reflected XSS vulnerabilities exist in Scrypted v55.0: (1) in plugin-http.ts where owner and pkg parameters are reflected unsanitized in 404 error responses with HTML content-type, and (2) in the Login.vue component where the redirect_uri parameter is directly assigned to window.location without validation, allowing javascript: scheme URIs. Both are network-accessible and require user interaction (clicking a malicious link). An attacker can inject arbitrary JavaScript that executes in the user's browser with the user's authentication context, potentially enabling RCE via authenticated RPC calls to trigger plugin updates or shell commands. No patch availability is currently documented.
Affected products
- Scrypted Contributors Scrypted v55.0
Timeline
- 2023-10-13: disclosed
- 2024-02-16: advisory