PT-2024-40021 · Passbolt · Passbolt

Published 2024-05-20 · Updated 2024-05-20

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions passbolt versions prior to 2.11

Description The issue allows an administrator to craft a user with a malicious first name and last name, using a payload such as <svg onload="confirm(document.domain)">'); ?></svg>. When the user receives the invitation email and clicks on the setup link, the setup start page served by the server will fire the XSS. This could be used to edit the setup start page for a given user, for example, tricking the user into installing another extension. Although the severity of this issue is high, the likelihood is low because the exploit will be visible to the user in the email notification and requires an action from a malicious administrator.

Recommendations For versions prior to 2.11, sanitize the firstname and lastname in the page that is used to trigger the extension setup process. Additionally, consider setting up Content Security Policy (CSP) in the web server configuration to prevent inline-scripts or 3rd party domain scripts on pages served by the passbolt API.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-2F46-4XJM-73X5

Affected Products

Passbolt

References · 6

• https://osv.dev/vulnerability/GHSA-2f46-4xjm-73x5 · Vendor Advisory
• https://github.com/passbolt/passbolt_api · Note
• https://github.com/passbolt/passbolt_api/commit/6135b483f72c6853e6085e329f5f8d7be60c9933 · Note
• https://github.com/passbolt/passbolt_api/blob/master/CHANGELOG.md#2110---2019-08-08 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/passbolt/passbolt_api/2019-08-07-1.yaml · Note
• https://passbolt.com/incidents/20190807_multiple_vulnerabilities · Note