CVE-2018-16407

Vulnerability

The vulnerability is a stored cross-site scripting (XSS) issue in the Tags app of Mayan EDMS versions prior to 3.0.3. When a tag's label value is not properly sanitized, the unsanitized value is injected into the DOM via JavaScript templates (mayan_app.js lines 62 and 71) during tag selection in document upload workflows. [1][4]

Exploitation

An attacker must have the ability to create or modify tags (typically any authenticated user can do so). The attacker creates a tag with a malicious label, such as test. When a victim user goes to upload a document, selects a document type, and then clicks into the tag input field, the application dynamically generates a `` element containing the unescaped label. This results in the injected script executing in the victim's browser context. [4]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, data exfiltration, or defacement of the application interface. The impact is scoped to the browser and the victim's privileges within Mayan EDMS. [1][4]

Mitigation

The issue is fixed in Mayan EDMS version 3.0.3 and later. Users should upgrade to the latest version. No official workaround is documented in the references. [1][2]