CVE-2024-29193 - Vulnerability Details - OpenCVE

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc’s origin. As of time of publication, no patch is available.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00127.

Key SSVC decision points have not yet been added.

Vendors	Products
Alexxit	Go2rtc

Configuration 1 [-]

cpe:2.3:a:alexxit:go2rtc:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/

History

Tue, 02 Sep 2025 17:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Alexxit Alexxit go2rtc
CPEs		cpe:2.3:a:alexxit:go2rtc::::::::
Vendors & Products		Alexxit Alexxit go2rtc

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-04-04T18:35:28.817Z

Updated: 2024-08-13T14:04:23.996Z

Reserved: 2024-03-18T17:07:00.095Z

Link: CVE-2024-29193

Vulnrichment

Updated: 2024-08-02T01:10:54.458Z

NVD

Status : Analyzed

Published: 2024-04-04T19:15:08.023

Modified: 2025-09-02T16:51:11.057

Link: CVE-2024-29193

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29193", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-18T17:07:00.095Z", "datePublished": "2024-04-04T18:35:28.817Z", "dateUpdated": "2024-08-13T14:04:23.996Z"}, "containers": {"cna": {"title": "GHSL-2023-207 gotortc DOM-based Cross-site Scripting vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "tags": ["x_refsource_CONFIRM"], "url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/"}], "affected": [{"vendor": "AlexxIT", "product": "go2rtc", "versions": [{"version": "<= 1.8.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-02T15:34:41.870Z"}, "descriptions": [{"lang": "en", "value": "gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc\u2019s origin. As of time of publication, no patch is available."}], "source": {"advisory": "GHSA-rh4r-f7f7-r99m", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:10:54.458Z"}, "title": "CVE Program Container", "references": [{"name": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/"}]}, {"affected": [{"vendor": "alexxit", "product": "go2rtc", "cpes": ["cpe:2.3:a:alexxit:go2rtc:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.8.5", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-05T16:07:56.146509Z", "id": "CVE-2024-29193", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T14:04:23.996Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "name": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:10:54.458Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29193", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-05T16:07:56.146509Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:alexxit:go2rtc:*:*:*:*:*:*:*:*"], "vendor": "alexxit", "product": "go2rtc", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "1.8.5"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T14:04:20.378Z"}}], "cna": {"title": "GHSL-2023-207 gotortc DOM-based Cross-site Scripting vulnerability", "source": {"advisory": "GHSA-rh4r-f7f7-r99m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "AlexxIT", "product": "go2rtc", "versions": [{"status": "affected", "version": "<= 1.8.5"}]}], "references": [{"url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "name": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc\u2019s origin. As of time of publication, no patch is available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-08-02T15:34:41.870Z"}}}, "cveMetadata": {"cveId": "CVE-2024-29193", "state": "PUBLISHED", "dateUpdated": "2024-08-13T14:04:23.996Z", "dateReserved": "2024-03-18T17:07:00.095Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-04T18:35:28.817Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:alexxit:go2rtc:*:*:*:*:*:*:*:*", "matchCriteriaId": "E44B0A46-58BF-40AE-A3F6-252E92C0DFF7", "versionEndIncluding": "1.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc\u2019s origin. As of time of publication, no patch is available."}, {"lang": "es", "value": "gotortc es una aplicaci\u00f3n de transmisi\u00f3n de c\u00e1mara. Las versiones 1.8.5 y anteriores son vulnerables a Cross-Site Scripting basadas en DOM. La p\u00e1gina de \u00edndice (`index.html`) muestra las transmisiones disponibles al obtener la API (`[0]`) en el lado del cliente. Luego, usa `Object.entries` para iterar sobre el resultado (`[1]`) cuyo primer elemento (`name`) se agrega usando `innerHTML` (`[2]`). En caso de que una v\u00edctima visite el servidor en cuesti\u00f3n, su navegador ejecutar\u00e1 la solicitud en la instancia de go2rtc. Despu\u00e9s de la solicitud, el navegador ser\u00e1 redirigido a go2rtc, en el que el XSS se ejecutar\u00e1 en el contexto del origen de go2rtc. Al momento de la publicaci\u00f3n, no hay ning\u00fan parche disponible."}], "id": "CVE-2024-29193", "lastModified": "2025-09-02T16:51:11.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-04T19:15:08.023", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}