CVE-2023-45815

CVE-2023-45815 describes a cross-site scripting (XSS) vulnerability in ArchiveBox, an open-source web archiving system, specifically when using the 'wget' extractor. An attacker could craft a malicious archived page that, when viewed by a logged-in administrator in the same browser session, could execute arbitrary JavaScript. This could lead to unauthorized modification of snapshots, user accounts, or other administrative actions within ArchiveBox. The vulnerability has a CVSS score of 5.4 MEDIUM, indicating a moderate severity. It requires user interaction (viewing a malicious page) and a logged-in session for maximum impact, but can still read other archived content for non-logged-in users. The issue stems from archived content and the admin panel sharing the same host and port, bypassing typical browser security. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. A patch is under development, and mitigations include disabling the wget extractor, ensuring users are logged out, or serving a static HTML version of the archive.