CVE-2024-35180: 
Python vulnerability analysis and mitigation

OMERO.web, a web-based client and plugin infrastructure, was found to contain a security vulnerability (CVE-2024-35180) related to insufficient validation of the JSONP callback parameter. The vulnerability affects versions up to and including 5.25.0 and has been patched in version 5.26.0. The issue was discovered and disclosed on May 21, 2024 (GitHub Advisory).

The vulnerability stems from a lack of escaping or validation of the 'callback' parameter that can be passed to various OMERO.web endpoints with JSONP enabled. One of the affected endpoints is '/webclient/imgData/...'. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (NVD).

While the vulnerability is difficult to exploit in vanilla OMERO.web due to its use of jQuery's callback name generation, it poses a potential risk particularly when used with plugins. The vulnerability could potentially lead to security issues when metadata endpoints are accessed by third-party plugins (GitHub Advisory).

The vulnerability requires user interaction to exploit, and while it's particularly challenging to exploit in vanilla OMERO.web implementations, the risk increases when used with plugins. No known active exploits have been reported in the wild (GitHub Advisory).

The vulnerability has been patched in OMERO.web version 5.26.0. Users are strongly advised to upgrade to this version or higher as there are no alternative workarounds available. The fix includes implementing proper validation of JavaScript variable names in the callback parameter (GitHub Commit).