Palo Alto Networks 发布安全公告，修复了 Prisma Cloud Compute 软件中的一个跨站脚本 (XSS) 漏洞。该漏洞允许具有身份提供者添加/编辑权限的恶意管理员使用 Prisma Cloud Compute 的 Web 界面存储 JavaScript 负载，从而在其他用户访问时以该用户的浏览器上下文执行操作。

😔 **漏洞描述:** Prisma Cloud Compute 软件中存在一个跨站脚本 (XSS) 漏洞，允许具有身份提供者添加/编辑权限的恶意管理员使用 Prisma Cloud Compute 的 Web 界面存储 JavaScript 负载。

😨 **漏洞影响:** 该漏洞允许恶意管理员在其他用户访问时以该用户的浏览器上下文执行操作，从而可能导致敏感信息泄露、恶意代码执行等安全风险。

🛡️ **解决方案:** Palo Alto Networks 已经发布了 Prisma Cloud Compute 32.05 (O'Neal - Update 5) 及更高版本，修复了该漏洞。建议用户尽快升级到最新版本以确保安全。

🙏 **致谢:** Palo Alto Networks 感谢 Tomasz Stachowicz 发现并报告了此漏洞。

🗓️ **时间线:** 2024-06-12 发布安全公告。

Palo Alto Networks Security Advisories /CVE-2024-5906CVE-2024-5906 Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web InterfaceUrgencyMODERATEResponse EffortMODERATERecoveryAUTOMATICValue DensityDIFFUSEAttack VectorNETWORKAttack ComplexityLOWAttack RequirementsNONEAutomatableNOUser InteractionPASSIVEProduct ConfidentialityLOWProduct IntegrityLOWProduct AvailabilityNONEPrivileges RequiredHIGHSubsequent ConfidentialityNONESubsequent IntegrityNONESubsequent AvailabilityNONENVDJSON Published2024-06-12 Updated2024-06-12ReferenceCWP-56273DiscoveredexternallyDescriptionA cross-site scripting (XSS) vulnerability in Palo Alto Networks Prisma Cloud Compute software enables a malicious administrator with add/edit permissions for identity providers to store a JavaScript payload using the web interface on Prisma Cloud Compute. This enables a malicious administrator to perform actions in the context of another user's browser when accessed by that other user.Product StatusVersionsAffectedUnaffectedPrisma Cloud Compute 32< 32.05 (O’Neal - Update 5)>= 32.05 (O’Neal - Update 5)Severity:MEDIUMCVSSv4.0Base Score:4.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:M/U:Amber)Exploitation StatusPalo Alto Networks is not aware of any malicious exploitation of this issue.Weakness TypeCWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')SolutionThis issue is fixed in Prisma Cloud Compute 32.05 (O'Neal - Update 5) and all later versions.AcknowledgmentsPalo Alto Networks thanks Tomasz Stachowicz for discovering and reporting this issue.Timeline2024-06-12Initial publication