eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The project has been archived since 2021, and as of time of publication there are no plans to patch this issue and release a new version. Some workarounds are available, including shutting down eDEX-UI when browsing the web and ensuring the eDEX terminal runs with lowest possible privileges.
References
Configurations
History
21 Nov 2024, 08:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://christian-schneider.net/CrossSiteWebSocketHijacking.html - Technical Description | |
| References | () https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458 - Product | |
| References | () https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9 - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.3 |
10 May 2023, 16:48
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:edex-ui_project:edex-ui:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 10.0 |
| CWE | ||
| References | (MISC) https://github.com/GitSquared/edex-ui/blob/04a00c4079908788b371c6ecdefff96d0d9950f8/src/classes/terminal.class.js#L458 - Product | |
| References | (MISC) https://github.com/GitSquared/edex-ui/security/advisories/GHSA-q8xc-f2wf-ffh9 - Vendor Advisory | |
| References | (MISC) https://christian-schneider.net/CrossSiteWebSocketHijacking.html - Technical Description |
28 Apr 2023, 17:06
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-28 16:15
Updated : 2024-11-21 08:00
NVD link : CVE-2023-30856
Mitre link : CVE-2023-30856
CVE.ORG link : CVE-2023-30856
JSON object : View
Products Affected
edex-ui_project
- edex-ui