GHSA-9phh-r37v-34wh lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files
Attackers with upload access can inject malicious JavaScript into HTML files, leading to session hijacking or data theft when victims open direct links.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-9phh-r37v-34wh?
GHSA-9phh-r37v-34wh is a cross-site scripting vulnerability in github.com/treeverse/lakefs, published on 14 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in.
An attacker can inject a malicious script inline, download resources from another domain, or make arbitrary HTTP requests. This would allow the attacker to send information to a random domain or carry out lakeFS operations while impersonating the victim.
Note that to carry out this attack, an attacker must already have access to upload the malicious HTML file to one or more repositories. It also depends on the victim receiving and opening the link to the malicious HTML file.
Patches
This is fixed in lakeFS version 0.106.0
Workarounds
There are no known workarounds at this time.
Which versions are affected by GHSA-9phh-r37v-34wh?
3 open source packages ship an affected version, including github.com/treeverse/lakefs.
| Package | Affected | Fixed in |
|---|---|---|
github.com/treeverse/lakefs Go | All versions | 0.106.0 |
github.com/treeverse/lakefs Go | All versions | 0.106.0 |
github.com/treeverse/lakefs Go | All versions | 0.106.0 |
How do I fix GHSA-9phh-r37v-34wh?
Upgrade github.com/treeverse/lakefs to 0.106.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-9phh-r37v-34wh being exploited?
There is no known exploitation of GHSA-9phh-r37v-34wh in the wild and no public exploit code.
Sources
Also known as GO-2023-2012.