CVE-2024-29193

gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc’s origin. As of time of publication, no patch is available.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/	Exploit Third Party Advisory
https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:alexxit:go2rtc:*:*:*:*:*:*:*:*

History

02 Sep 2025, 16:51

Type	Values Removed	Values Added
CPE		cpe:2.3:a:alexxit:go2rtc::::::::
First Time		Alexxit go2rtc Alexxit
References	~~() https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/ -~~	() https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/ - Exploit, Third Party Advisory

Information

Published : 2024-04-04 19:15

Updated : 2025-09-02 16:51

NVD link : CVE-2024-29193

Mitre link : CVE-2024-29193

CVE.ORG link : CVE-2024-29193

JSON object : View

Products Affected

alexxit

go2rtc

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-29193", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-04-04T19:15:08.023", "references": [{"url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://securitylab.github.com/advisories/GHSL-2023-205_GHSL-2023-207_go2rtc/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "gotortc is a camera streaming application. Versions 1.8.5 and prior are vulnerable to DOM-based cross-site scripting. The index page (`index.html`) shows the available streams by fetching the API in the client side. Then, it uses `Object.entries` to iterate over the result whose first item (`name`) gets appended using `innerHTML`. In the event of a victim visiting the server in question, their browser will execute the request against the go2rtc instance. After the request, the browser will be redirected to go2rtc, in which the XSS would be executed in the context of go2rtc\u2019s origin. As of time of publication, no patch is available."}, {"lang": "es", "value": "gotortc es una aplicaci\u00f3n de transmisi\u00f3n de c\u00e1mara. Las versiones 1.8.5 y anteriores son vulnerables a Cross-Site Scripting basadas en DOM. La p\u00e1gina de \u00edndice (`index.html`) muestra las transmisiones disponibles al obtener la API (`[0]`) en el lado del cliente. Luego, usa `Object.entries` para iterar sobre el resultado (`[1]`) cuyo primer elemento (`name`) se agrega usando `innerHTML` (`[2]`). En caso de que una v\u00edctima visite el servidor en cuesti\u00f3n, su navegador ejecutar\u00e1 la solicitud en la instancia de go2rtc. Despu\u00e9s de la solicitud, el navegador ser\u00e1 redirigido a go2rtc, en el que el XSS se ejecutar\u00e1 en el contexto del origen de go2rtc. Al momento de la publicaci\u00f3n, no hay ning\u00fan parche disponible."}], "lastModified": "2025-09-02T16:51:11.057", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:alexxit:go2rtc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E44B0A46-58BF-40AE-A3F6-252E92C0DFF7", "versionEndIncluding": "1.8.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}