CyberRota Analysis
AI-GeneratedThe wetty client prior to version 3.0.4 is vulnerable to a cross-site scripting (XSS) attack due to improper handling of base64-encoded filenames, allowing attackers to inject malicious scripts that can execute in the context of the victim's SSH session. This vulnerability can lead to unauthorized actions being performed on the victim's system, posing a significant risk to users who rely on wetty for terminal access. Organizations using wetty should prioritize upgrading to version 3.0.4 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.