th30d4y IP DOM-Based Cross-Site Scripting Vulnerability

A DOM-Based Cross-Site Scripting (XSS) vulnerability has been identified in the th30d4y/IP IP Reputation Checker application, affecting versions 1.0.1 prior to 2.0.1. The vulnerability arises from unsanitized user input being directly rendered in the browser, which allows attackers to execute arbitrary JavaScript. This issue could lead to session hijacking, credential theft, phishing attacks, and full client-side compromise.

Impact

Exploitation of this vulnerability could result in session hijacking, credential theft, phishing attacks, and full client-side compromise.

Remediation

Users are advised to update to version 2.0.1. For those maintaining version 1.0.1, it is recommended to use safe DOM handling methods, such as 'textContent', instead of rendering raw HTML, and to validate or sanitize all user inputs.