PT-2024-21303 · Unknown · Label Studio

Isacaya

·

Published

2024-02-22

·

Updated

2024-02-23

·

CVE-2024-26152

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.11.0
Description The issue arises from improper sanitization of data imported via the file upload feature, which is then rendered within a Choices or Labels tag, resulting in an XSS vulnerability. To exploit this, an attacker needs permission to use the "data import" function. This vulnerability can lead to malicious scripts being injected into the code. When combined with other vulnerabilities, such as CSRF, it can cause greater damage, potentially leading to further attacks, especially those linked to social engineering.
Recommendations For Label Studio versions prior to 1.11.0, update to version 1.11.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload feature to minimize the risk of exploitation. Additionally, avoid using the html parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

Related Identifiers

CVE-2024-26152
GHSA-6XV9-957J-QFHG
PYSEC-2024-249

Affected Products

Label Studio