CVE-2021-41132 Inconsistent input sanitisation leads to XSS vectors
Attackers can execute arbitrary scripts via unsanitized input in OMERO.web templates, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41132?
CVE-2021-41132 is a critical cross-site scripting vulnerability in omero-web, published on 14 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.
Which versions are affected by CVE-2021-41132?
6 open source packages ship an affected version, including omero-web and omero-figure. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
omero-web PyPI | All versions | 5.11.0 |
omero-web PyPI | All versions | 5.11.0 |
omero-web PyPI | All versions | 5.11.0 |
omero-figure PyPI | All versions | 4.4.1 |
omero-figure PyPI | All versions | 4.4.1 |
omero-figure PyPI | All versions | 4.4.1 |
Products include Openmicroscopy Omero-Figure, Openmicroscopy Omero-Web.
How do I fix CVE-2021-41132?
Upgrade omero-web to 5.11.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-41132 being exploited?
There is no known exploitation of CVE-2021-41132 in the wild and no public exploit code.
Sources
Also known as GHSA-g67g-hvc3-xmvf, PYSEC-2021-372, PYSEC-2021-379.