{"id":"GHSA-8c8c-4vfj-rrpc","aliases":[],"status":"published","title":"Reflected Cross-Site Scripting in redis-commander","description":"Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander.\n\nMitigating factors:\nFlash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the [Flash NPAPI Windows plugin](https://get.adobe.com/flashplayer/otherversions/)\n\n## Proof of concept\n\n```\nhttp://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\\%22))}%20catch(e)%20{alert(document.domain);}//\n```\n\n\n## Recommendation\n\nNo direct patch for this vulnerability is currently available.\n\nAt this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-09-01T19:05:11Z","modified":"2023-01-09T05:03:53Z","fixes":[{"ecosystem":"npm","package":"redis-commander","fixed_in":["0.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"redis-commander","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.0"},{"fixed":"0.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"redis-commander","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0"},{"fixed":"0.5.0"}]}]}],"references":[{"url":"https://hackerone.com/reports/296377","tags":["web"]},{"url":"https://www.npmjs.com/advisories/562","tags":["web"]},{"url":"https://github.com/joeferner/redis-commander/commit/1a483ebb3a706cf199dd283cf0aead96606adb14","tags":["web"]},{"url":"https://github.com/joeferner/redis-commander/releases/tag/v0.5.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8c8c-4vfj-rrpc"},{"url":"https://github.com/joeferner/redis-commander","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-8c8c-4vfj-rrpc","title":"Reflected Cross-Site Scripting in redis-commander","description":"Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander.\n\nMitigating factors:\nFlash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the [Flash NPAPI Windows plugin](https://get.adobe.com/flashplayer/otherversions/)\n\n## Proof of concept\n\n```\nhttp://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\\%22))}%20catch(e)%20{alert(document.domain);}//\n```\n\n\n## Recommendation\n\nNo direct patch for this vulnerability is currently available.\n\nAt this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.","status":"published","published":"2020-09-01T19:05:11Z","modified":"2023-01-09T05:03:53Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:06.884904Z"}],"osv":[{"id":"GHSA-8c8c-4vfj-rrpc","title":"Reflected Cross-Site Scripting in redis-commander","description":"Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander.\n\nMitigating factors:\nFlash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the [Flash NPAPI Windows plugin](https://get.adobe.com/flashplayer/otherversions/)\n\n## Proof of concept\n\n```\nhttp://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\\%22))}%20catch(e)%20{alert(document.domain);}//\n```\n\n\n## Recommendation\n\nNo direct patch for this vulnerability is currently available.\n\nAt this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.","status":"published","published":"2020-09-01T19:05:11Z","modified":"2022-03-04T22:02:50Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}