Server side cross-site scripting In @dependencytrack/frontend
Description
@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via welcome message
Description
Since version 4.12.0, Dependency-Track users with the SYSTEM_CONFIGURATION permission can configure a "welcome message", which is HTML that is to be rendered on the login page for branding purposes.
When rendering the welcome message, Dependency-Track versions before 4.13.6 did not properly sanitize the HTML, allowing arbitrary JavaScript to be executed.
Impact
Users with the SYSTEM_CONFIGURATION permission (i.e., administrators), can exploit this weakness to execute arbitrary JavaScript for users browsing to the login page.
Patches
The issue has been fixed in version 4.13.6.
References
The issue was introduced via: https://github.com/DependencyTrack/frontend/pull/986
The issue was fixed via: https://github.com/DependencyTrack/frontend/pull/1378
Credit
Thanks to Jonas Benjamin Friedli for identifying and responsibly disclosing the issue.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 4.13.6 |
Aliases
References