GHSA-v86m-j5f7-ccwh Passbolt Api E-mail HTML injection
Authenticated attackers can inject HTML into Passbolt notification emails to potentially leak recipient mail client information.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-v86m-j5f7-ccwh?
GHSA-v86m-j5f7-ccwh is a cross-site scripting vulnerability in passbolt/passbolt_api, published on 20 May 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description.
Passbolt does not escape the user’s input properly, resulting in the user being able to inject HTML code in an e-mail.
An authenticated attacker could share a password containing an img HTML tag in its description with an other user to obtain information about their mail user-agent.
This vulnerability has a very low impact. Most MUA do not embed remote images to protect their users’ privacy.
Which versions are affected by GHSA-v86m-j5f7-ccwh?
2 open source packages ship an affected version, including passbolt/passbolt_api.
| Package | Affected | Fixed in |
|---|---|---|
passbolt/passbolt_api Packagist | All versions | 2.7.0 |
passbolt/passbolt_api Packagist | All versions | 2.7.0 |
How do I fix GHSA-v86m-j5f7-ccwh?
Upgrade passbolt/passbolt_api to 2.7.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-v86m-j5f7-ccwh being exploited?
There is no known exploitation of GHSA-v86m-j5f7-ccwh in the wild and no public exploit code.