Versions of @novnc/novnc
prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of include/ui.js
and users of vnc_auto.html
and vnc.html
.
Upgrade to version 0.6.2 or later.
CPE | Name | Operator | Version |
---|---|---|---|
@novnc/novnc | lt | 0.6.2 |
access.redhat.com/errata/RHSA-2020:0754
bugs.launchpad.net/horizon/+bug/1656435
github.com/novnc/noVNC
github.com/novnc/noVNC/commit/6048299a138e078aed210f163111698c8c526a13#diff-286f7dc7b881e942e97cd50c10898f03L534
github.com/novnc/noVNC/issues/748
github.com/novnc/noVNC/releases/tag/v0.6.2
github.com/ShielderSec/cve-2017-18635
lists.debian.org/debian-lts-announce/2019/10/msg00004.html
lists.debian.org/debian-lts-announce/2021/12/msg00024.html
nvd.nist.gov/vuln/detail/CVE-2017-18635
snyk.io/vuln/SNYK-JS-NOVNCNOVNC-469136
usn.ubuntu.com/4522-1
www.npmjs.com/advisories/1204
www.shielder.it/blog/exploiting-an-old-novnc-xss-cve-2017-18635-in-openstack