CyberRota Analysis
AI-GeneratedPrivateBin versions prior to 2.0.5 are vulnerable due to improper handling of attacker-controlled MIME types in the AttachmentViewer, allowing malicious SVG and other file types to execute inline JavaScript when a victim opens a download link. This can lead to unauthorized access to local storage and potential exploitation of co-hosted applications. Organizations using affected versions should prioritize updating to 2.0.5 to mitigate the risk of these attacks, especially if they have file upload capabilities enabled and a weak Content Security Policy.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting attachmentLink's href for the Download attachment link. The SVG-only sanitization branch updates only the preview blob, so text/html, image/svg, application/xhtml+xml, and text/xml attachments can remain active in the download blob. On an instance with fileupload = true and a weakened, stripped, or absent Content Security Policy, an anonymous attacker can create such an attachment, and a victim who opens the link in a new tab causes inline JavaScript to execute in the PrivateBin origin. The script can read origin-scoped local storage and issue same-origin requests, including requests to applications co-hosted on the same domain. This issue is fixed in version 2.0.5.