{"answers":{"affected":"2 open source packages ship an affected version, including @saltcorn/server.","exploited":"There is no known exploitation of GHSA-pf56-h9qf-rxq4 in the wild and no public exploit code.","fix":"Upgrade @saltcorn/server to 1.0.0-beta.16 or later.","what":"GHSA-pf56-h9qf-rxq4 is a cross-site scripting vulnerability in @saltcorn/server, published on 7 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-pf56-h9qf-rxq4 and fix it if it is affected.\n\nWhat it is: GHSA-pf56-h9qf-rxq4 is a cross-site scripting vulnerability in @saltcorn/server, published on 7 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-pf56-h9qf-rxq4 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @saltcorn/server (npm): affected all versions; fixed in 1.0.0-beta.16\n- @saltcorn/server (npm): affected all versions; fixed in 1.0.0-beta.16\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-pf56-h9qf-rxq4/ (Markdown: https://insights.sbomify.com/GHSA-pf56-h9qf-rxq4/index.md)","id":"GHSA-pf56-h9qf-rxq4","markdown":"https://insights.sbomify.com/GHSA-pf56-h9qf-rxq4/index.md","name":"GHSA-pf56-h9qf-rxq4","record":{"aliases":[],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["account_takeover","data_read"],"network_reachable":"yes","non_default_config":true,"product_category":"Saltcorn server","requires_auth":"low_privilege","summary":"A low-privileged user can inject malicious scripts into event logs, which execute when an admin views the logs, potentially leading to account takeover.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nEvent log data is not properly sanitized leading to stored Cross-Site Scripting (XSS) vulnerability.\n### Details\n\n- file: https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/eventlog.js#L445\n\n```js\nrouter.get(\n  \"/:id\",\n  isAdmin,\n  error_catcher(async (req, res) =\u003e {\n    const { id } = req.params;\n    const ev = await EventLog.findOneWithUser(id);\n    send_events_page({\n      [...]\n      contents: {\n        type: \"card\",\n        contents:\n          [...]\n          ) +\n          div(\n            { class: \"eventpayload\" },\n            ev.payload ? pre(JSON.stringify(ev.payload, null, 2)) : \"\" //\u003c---\n          ),\n      },\n    });\n  })\n\n```\n\n### PoC\n\nThe following PoC demonstrates how a non-admin user with permission to read/write on a table can inject malicious javascript code that will be executed in the event log admin panel if event logs are enabled.\n\nTo demonstrate this issue, we need to prepare some components. The following steps should be executed with an admin user.\n\n1. create a table with one column of type string set read/write permission to staff users (just as an example)\n  - visit `http://localhost:3000/table/new`\n  - create a table with `Table name` `my_table_xss` and click `Create`\n  - click `Add field` to add a field with `Label` called `payload` of type `String` and click `Next \u003e\u003e`\n  - leave default values for `Attributes` and click `Next \u003e\u003e` - it should redirect to `http://localhost:3000/table/\u003ctable-number\u003e`\n  - under `Edit table properties`, set `Minimum role to read` and `Minimum role to write` to `staff`\n\n2. create an edit view so that staff users can insert more data\n  - visit `http://localhost:3000/viewedit` anc click `Create View`\n  - set the following values:\n    - `View name`: `my_xss_view`\n    - `View pattern`: `Edit`\n    - `Table`: `my_table_xss`\n    - `Minimum role`: `staff`\n  - click `Configure \u003e\u003e`\n  - on page `http://localhost:3000/viewedit/config/my_xss_view` click `Next \u003e\u003e` and then `Finish \u003e\u003e`\n  - you should see a message `View my_xss_view saved`\n\n3. edit the site structure to add the View just created so that `staff` users can access it\n  - visit `http://localhost:3000/menu`\n  - set the following values:\n    - `Type`: `View`\n    - `View`: `my_xss_view [Edit]`\n    - `Text label`: `view`\n    - `Minimum role`: `staff`\n  - click `Add`\n\n4. create an event that will log when data is inserted in the `my_table_xss` table create at step 1\n  - visit `http://localhost:3000/eventlog/settings`\n  - under `Which events should be logged?` select:\n    - `[X] Insert`\n    - `[X] Insert my_table_xss`\n\nLogin with a user with staff role (you can do the same steps also with an admin user)\n- visit `http://localhost:3000/view/my_xss_view`\n- in the `payload` field insert ``\"\u003csvg/onload=alert(`xss`)\u003e`` and click `Save`\n\nWith an admin user inspect the log entry generated by the above action:\n- visit `http://localhost:3000/eventlog`\n- click on the event log generated (`http://localhost:3000/eventlog/\u003cevent-number\u003e`)\n- an alert will appear\n\n### Impact\n\nStored Cross-Site Scripting (XSS)\n\n### Recommended Mitigation\n\nSanitize the user input before building HTML elements","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Saltcorn Server Stored Cross-Site Scripting (XSS) in event logs page","id":"GHSA-pf56-h9qf-rxq4","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"xss","year":"2024"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["1.0.0-beta.16"],"introduced":["0"],"last_affected":[],"package":"@saltcorn/server","purl":null,"source":"GHSA-pf56-h9qf-rxq4"},{"ecosystem":"npm","fixed":["1.0.0-beta.16"],"introduced":["0"],"last_affected":[],"package":"@saltcorn/server","purl":"pkg:npm/%40saltcorn/server","source":"GHSA-pf56-h9qf-rxq4"}],"products":null,"published":"2024-10-07","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"A low-privileged user can inject malicious scripts into event logs, which execute when an admin views the logs, potentially leading to account takeover.","url":"https://insights.sbomify.com/GHSA-pf56-h9qf-rxq4/"}