CVE-2017-18635 : What You Need to Know

noVNC versions earlier than 0.6.2 have a Cross-Site Scripting (XSS) vulnerability that allows remote VNC servers to inject arbitrary HTML code into the noVNC web page.

Understanding CVE-2017-18635

This CVE involves an XSS vulnerability in noVNC versions prior to 0.6.2, enabling malicious injection of HTML code into the noVNC web page.

What is CVE-2017-18635?

XSS vulnerability in noVNC before version 0.6.2
Allows remote VNC servers to insert random HTML code into the noVNC web page
Injection occurs through messages sent to the status field

The Impact of CVE-2017-18635

Malicious HTML injection can lead to unauthorized access or data theft
Attackers can execute arbitrary code within the context of the user's browser

Technical Details of CVE-2017-18635

noVNC versions prior to 0.6.2 are susceptible to an XSS vulnerability that can be exploited by remote VNC servers.

Vulnerability Description

XSS vulnerability in noVNC versions earlier than 0.6.2
Allows remote VNC servers to inject arbitrary HTML into the noVNC web page

Affected Systems and Versions

noVNC versions before 0.6.2

Exploitation Mechanism

Injection of malicious HTML code through messages sent to the status field

Mitigation and Prevention

To address CVE-2017-18635, follow these mitigation strategies:

Immediate Steps to Take

Upgrade to version 0.6.2 or later of noVNC
Implement input validation to prevent malicious code injection

Long-Term Security Practices

Regularly update software to the latest versions
Conduct security audits to identify and address vulnerabilities

Patching and Updates

Apply security patches provided by noVNC to fix the XSS vulnerability