CVE-2024-2435 Stored XSS in Timeline View

What is CVE-2024-2435?

CVE-2024-2435 is a medium-severity cross-site scripting vulnerability in Temporal OSS ui-server, published on 2 Apr 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal. The XSS is in the timeline page displaying the workflow execution details of the workflow that was sent the crafted signal. Access to send a signal to a workflow is determined by how you configured the authorizer on your server. This includes any entity with permission to directly call SignalWorkflowExecution or SignalWithStartWorkflowExecution, or any entity can deploy a worker that has access to call workflow progress APIs (specifically RespondWorkflowTaskCompleted).

Weakness: CWE-79

Which versions are affected by CVE-2024-2435?

4 open source packages ship an affected version, including github.com/temporalio/ui-server/v2 and github.com/temporalio/ui-server.

How do I fix CVE-2024-2435?

Upgrade github.com/temporalio/ui-server/v2 to 2.25.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-2435 being exploited?

There is no known exploitation of CVE-2024-2435 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8f25-w7qj-r7hc, GO-2024-2675.