GHSA-63cr-xg3f-8jvr Leantime allows Stored Cross-Site Scripting (XSS)

Not scored Published 21 Feb 2025

Stored XSS in Leantime allows attackers to execute scripts in victim browsers via webhook payloads, potentially stealing sessions or credentials.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is GHSA-63cr-xg3f-8jvr?

GHSA-63cr-xg3f-8jvr is a cross-site scripting vulnerability in leantime/leantime, published on 21 Feb 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Summary

Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.

Details

A Stored Cross-Site Scripting (XSS) vulnerability was found that could potentially compromise user data and pose a significant security risk to the platform.

PoC

Create a project
Navigate to project
Visit to the integration
Add malicious payload inside the webhook and save it.
Notice the alert dialogue indicating successful execution of the XSS payload.

&#39;&#39;;!--&#34; onfocus=alert(0) autofocus=&#34;&#34;  onload=alert(3);=&#34;&amp;amp;{(alert(1))}&#34; |=&#34;&#34; mufazmi&#34;=&#34;

&#39;&#39;;!--&#34; onfocus=alert(0) autofocus=&#34;&#34;  onload=alert(3);=&gt;&gt;&#34;&amp;amp;{(alert(1))}&#34; |=&#34;&#34;&gt;&gt; mufazmi&#34;=&#34;&gt;&gt;

POC

https://youtu.be/kqKFgsOqstg

Impact

This XSS vulnerability allows an attacker to execute malicious scripts in the context of a victim's browser when they click on a specially crafted link. This could lead to various malicious activities, including session hijacking, stealing sensitive information such as cookies or login credentials, and potentially compromising the entire platform's security.

Which versions are affected by GHSA-63cr-xg3f-8jvr?

2 open source packages ship an affected version, including leantime/leantime.

Package	Affected	Fixed in
`leantime/leantime` Packagist	All versions to `3.1.4`	None
`leantime/leantime` Packagist	All versions to `3.1.4`	None

How do I fix GHSA-63cr-xg3f-8jvr?

No fix has been published for GHSA-63cr-xg3f-8jvr yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-63cr-xg3f-8jvr being exploited?

There is no known exploitation of GHSA-63cr-xg3f-8jvr in the wild and no public exploit code.