Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-34343
CVE-2024-34343:
JavaScript vulnerability analysis and mitigation
Overview
Nuxt, a free and open-source framework for creating full-stack web applications with Vue.js, was found to contain a vulnerability in its navigateTo function. The vulnerability (CVE-2024-34343) was discovered and disclosed on August 5, 2024, affecting versions prior to 3.12.4. The issue stems from incorrect implementation of protocol blocking mechanisms, specifically in handling the javascript: protocol using the unjs/ufo library APIs (GitHub Advisory).
Technical details
The vulnerability arises from parsing discrepancies in the URL handling mechanism. The navigateTo function first checks for protocol using the unjs/ufo package, which correctly identifies javascript: protocols. However, the subsequent parseURL function refuses to parse poorly formatted URLs, returning null/empty values. The isScriptProtocol function, which checks against a protocol list, fails to perform proper parsing. Additionally, whitespace is not stripped in the parseURL implementation, allowing bypass of isScriptProtocol checks. Special protocols can be bypassed by inserting newline or tab characters into the sequence. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (Medium) by NIST and 6.3 (Medium) by GitHub (NVD, GitHub Advisory).
Impact
The vulnerability can lead to Cross-Site Scripting (XSS) attacks, but only after Server-Side Rendering (SSR) has occurred. Successful exploitation could allow attackers to access cookies and make requests on behalf of users. The javascript: protocol within a location header does not trigger XSS (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in version 3.12.4 and all users are advised to upgrade to this version or later. There are no known workarounds for this vulnerability (NVD).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management