x/vulndb: potential Go vuln in github.com/projectdiscovery/interactsh: CVE-2023-36474

[GoVulnBot]

CVE-2023-36474 references github.com/projectdiscovery/interactsh, which may be a Go module.

Description:
Interactsh is an open-source tool for detecting out-of-band interactions. Domains configured with interactsh server prior to version 1.0.0 were vulnerable to subdomain takeover for a specific subdomain, i.e app. Interactsh server used to create cname entries for app pointing to projectdiscovery.github.io as default, which intended to used for hosting interactsh web client using GitHub pages. This is a security issue with a self-hosted interactsh server in which the user may not have configured a web client but still have a CNAME entry pointing to GitHub pages, making them vulnerable to subdomain takeover. This allows a threat actor to host / run arbitrary client side code (cross-site scripting) in a user's browser when browsing the vulnerable subdomain. Version 1.0.0 fixes this issue by making CNAME optional, rather than default.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-36474
• JSON: https://github.com/CVEProject/cvelist/tree/cdac9c921cc388f3dcd9f025cae3a73b1f68dee6/2023/36xxx/CVE-2023-36474.json
• advisory: GHSA-m36x-mgfh-8g78
• report: deprecate default cname entry projectdiscovery/interactsh#136
• fix: Making app CNAME optional projectdiscovery/interactsh#155
• web: https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/
• Imported by: https://pkg.go.dev/github.com/projectdiscovery/interactsh?tab=importedby

Cross references:

• Module github.com/projectdiscovery/interactsh appears in issue x/vulndb: potential Go vuln in github.com/projectdiscovery/interactsh: GHSA-m36x-mgfh-8g78 #372 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/projectdiscovery/interactsh
      vulnerable_at: 1.1.4
      packages:
        - package: interactsh
description: |-
    Interactsh is an open-source tool for detecting out-of-band interactions.
    Domains configured with interactsh server prior to version 1.0.0 were vulnerable
    to subdomain takeover for a specific subdomain, i.e `app.` Interactsh server
    used to create cname entries for `app` pointing to `projectdiscovery.github.io`
    as default, which intended to used for hosting interactsh web client using
    GitHub pages. This is a security issue with a self-hosted interactsh server in
    which the user may not have configured a web client but still have a CNAME entry
    pointing to GitHub pages, making them vulnerable to subdomain takeover. This
    allows a threat actor to host / run arbitrary client side code (cross-site
    scripting) in a user's browser when browsing the vulnerable subdomain. Version
    1.0.0 fixes this issue by making CNAME optional, rather than default.
cves:
    - CVE-2023-36474
references:
    - advisory: https://github.com/projectdiscovery/interactsh/security/advisories/GHSA-m36x-mgfh-8g78
    - report: https://github.com/projectdiscovery/interactsh/issues/136
    - fix: https://github.com/projectdiscovery/interactsh/pull/155
    - web: https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/

[gopherbot]

Change https://go.dev/cl/507896 mentions this issue: data/excluded: batch add 10 excluded reports

[tatianab]

Duplicate of #372