CVE-2023-1767 PoC — Snyk Advisor 跨站脚本漏洞

Source

https://github.com/weizman/CVE-2023-1767

Associated Vulnerability

Title: Snyk Advisor 跨站脚本漏洞 (CVE-2023-1767)
Description:The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor.

Readme

# Stored XSS `snyk.io` Discovery (19/03/23)

## [CVE-2023-1767](https://nvd.nist.gov/vuln/detail/CVE-2023-1767)

## [Responsible Vulnerability Disclosure Report](./report/)

## [Vulnerability blog post coverage](https://weizman.github.io/2023/04/10/snyk-xss/)

## [Exploit PoC](./demo/)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →