Cross-site scripting in Corteza - #VU156178

Vulnerability details

The vulnerability allows a remote user to execute arbitrary JavaScript in other users' browser sessions, disclose sensitive information, and perform unauthorized actions with the victims' privileges, including administrative privileges.

The vulnerability exists due to improper output neutralization in Corteza's xss.RichText function when decoding HTML entities after sanitization, combined with the Compose Calendar block rendering stored event titles through innerHTML. A remote user can create a record with an attacker-writable Calendar title field containing <img src=x onerror=alert(window.__xss=document.domain)> to persist executable HTML that runs in a victim's browser when the victim opens the Calendar page.

Affected software

Remediation

External References

• https://github.com/cortezaproject/corteza/security/advisories/GHSA-j8cx-q7xw-8r7f

Related Security Bulletins

• Multiple vulnerabilities in Corteza