TI-2024-27721 Aliases CVE-2024-41658 GHSA-gv2p-4mvg-g32h

GHSL-2024-036: Reflected XSS in QrCodePage.js

MEDIUM 60CWE-79Published 2024-08-20 · Updated 2024-08-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. In Casdoor 1.577.0 and earlier, he purchase URL that is created to generate a WechatPay QR code is vulnerable to reflected XSS. When purchasing an item through casdoor, the product page allows you to pay via wechat pay. When using wechat pay, a QR code with the wechat pay link is displayed on the payment page, hosted on the domain of casdoor. This page takes a query parameter from the url successUrl, and redirects the user to that url after a successful purchase. Because the user has no reason to think that the payment page contains sensitive information, they may share it with other or can be social engineered into sending it to others. An attacker can then craft the casdoor link with a special url and send it back to the user, and once payment has gone though an XSS attack occurs.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00448 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Casdoor	casdoor	up to 1.577.0	—	No fix listed	CNA
—	github.com/casdoor/casdoor (Go)	up to 1.577.0	—	No fix listed	GHSA-gv2p-4mvg-g32h

casdoor VendorCasdoor Affected up to 1.577.0 Fixed in — No fix listed CNA
github.com/casdoor/casdoor (Go) Vendor— Affected up to 1.577.0 Fixed in — No fix listed GHSA-gv2p-4mvg-g32h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:casbin:casdoor::::::::	all versions	Vulnerable	Casdoor

cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Casdoor

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-41658
2026-10-03 Alias added: GHSA-gv2p-4mvg-g32h

References

Exploit 1

https://securitylab.github.com/advisories/GHSL-2024-035_GHSL-2024-036_casdoor/

Advisory 2

Other 2

TI-2024-27720 GHSL-2024-035: Casdoor CORS misconfiguration CVSS 3.1HIGH 8.8
TI-2022-22096 Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function. CVSS 3.1HIGH 8.1
TI-2022-08069 The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the… CVSS 3.1HIGH 7.5
TI-2023-17434 Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF)… CVSS 3.1MEDIUM 6.5
TI-2026-04788 Casdoor OAuth Authorization Request redirect CVSS 4.0MEDIUM 5.3
TI-2022-18179 Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the… CVSS 3.1CRITICAL 9.1

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences