NREL api-umbrella-web Flash Message cross site scripting

Vulnerability

A cross-site scripting (XSS) vulnerability exists in api-umbrella-web version 0.7.1 within the Flash Message Handler component of the admin interface. The vulnerability arises because user-controlled fields (e.g., admin group name, username) are not properly escaped before being included in flash messages, allowing injection of arbitrary HTML and JavaScript. The patch [1] demonstrates the addition of _.escape() calls to sanitize these inputs.

Exploitation

An attacker with the ability to create or edit admin groups or admins can exploit this vulnerability remotely by submitting a crafted payload (e.g., via the group name or username field). When the form is saved, the payload is rendered as part of a flash message in the admin interface, executing in the context of an authenticated admin session. No additional user interaction is required beyond the attacker's action.

Impact

Successful exploitation enables an attacker to execute arbitrary JavaScript in the admin panel, potentially leading to session hijacking, data theft, defacement, or other malicious actions within the admin interface. The scope is limited to the admin context but could allow privilege escalation depending on the victim's permissions.

Mitigation

The issue is fixed in version 0.8.0 [2]. Users should upgrade to this version or apply the commit bcc0e922c61d30367678c8f17a435950969315cd manually if upgrading is not immediately possible [1]. No workarounds are documented.