Krpano Panorama Viewer is a commercial viewer for displaying 360 degree panoramic images, videos and interactive virtual tours on websites. It runs in the browser using HTML5 and WebGL and is embedded into pages through a JavaScript embedding function. Tours are described with XML configuration files that define scenes, hotspots and user interface elements. The viewer can be extended with plugins that add features such as maps, galleries and navigation controls. It is widely used by real estate agencies, hotels, museums, tourism organizations and photographers to present places online. Many virtual tour authoring tools bundle the viewer files into every exported tour, so the same viewer version is often deployed across many pages.
Krpano Panorama Viewer 1.20.8 and earlier is affected by a reflected Cross-Site Scripting vulnerability. The weakness appears when the page embedding the viewer allows plugin related query parameters to be passed to the viewer. In this case the viewer accepts a plugin location from the page URL without restricting it to trusted sources. A script provided this way is loaded and executed in the origin of the website that hosts the tour. Exploitation requires a victim to open a crafted link, so user interaction is needed. The vulnerability is tracked as CVE-2020-24901 with a CVSS score of 6.1.
The issue is located in the client side handling of query string parameters by the krpano viewer. When query parameter forwarding is enabled in the embedding code, plugin related parameters supplied in the URL are honored by the viewer. One of these parameters controls the location from which a viewer plugin script is loaded. In affected versions this location is not limited to the hosting site or to a list of trusted origins. As a result, a script hosted on an external domain can run in the context of the page that embeds the viewer. The scanner verifies the condition safely by opening the viewer in a headless browser and checking whether a harmless test script is executed.
An attacker who convinces a user to open a crafted link can run arbitrary JavaScript in the user's browser under the origin of the affected website. This can be used to steal session cookies or tokens that are not protected, and to take over user sessions. The attacker can perform actions on behalf of the victim, read data shown on the page or change its content. The trusted domain of the tour can be abused to show fake login forms and collect credentials. Malicious redirects and drive-by content can damage the reputation of the organization that publishes the tour.
REFERENCES
- Upgrade the krpano viewer files to the latest available release, and replace old copies that were bundled into previously exported tours.
- Review every embedding call and set the query parameter forwarding option to an explicit list of required parameters instead of allowing all of them, and keep plugin related parameters out of that list.
- Keep the viewer's same origin security setting enabled so that external resources are not loaded into tours.
- Apply a Content Security Policy that limits script sources to the hosting domain and trusted content delivery networks.
- Keep an inventory of all published tours, including tours hosted on subdomains and marketing microsites, and check them after each viewer update.
- Monitor web server logs for tour URLs that carry unexpected query parameters pointing to external domains.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →