CVE-2020-13258

The vulnerability is a reflected cross-site scripting (XSS) issue in the Contentful Python example application (the-example-app.py) as of May 21, 2020 [1]. The root cause lies in the query_string() function in routes/base.py, which constructs a query string from user-supplied parameters. While it rejects certain keys like space_id and delivery_token, it does not sanitize the values of other parameters, allowing arbitrary HTML/JavaScript to be injected [1].

An attacker can exploit this by crafting a URL with a malicious api parameter (or any non-rejected parameter) containing script payloads. For example, the proof-of-concept URL https://the-example-app-py.contentful.com/?cda'"&locale=de-DE triggers the XSS when a victim visits the link [1]. The injected payload is reflected in the page because the query_string output is used unsafely in template contexts like href="/courses/{{ course.slug }}{{ query_string }}" [1].

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session on the affected domain. This can lead to session hijacking, credential theft, or defacement. The attack requires no authentication and can be delivered via phishing or other social engineering [1][2].

As of the publication date (2020-05-21), no patch was available; the issue was reported via the project's GitHub issue tracker [1]. Users are advised to manually sanitize all user-controlled input in the query_string function or upgrade to a patched version if released. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.