CVE-2020-36396

Vulnerability

Stored cross-site scripting (XSS) vulnerability in LavaLite 5.8.0, specifically in the /admin/roles/role component. The "New" parameter does not properly sanitize user input, allowing authenticated users to store malicious payloads that execute when the role is viewed. [1][2]

Exploitation

An attacker must have authenticated access to the LavaLite admin panel. Steps: navigate to /admin/roles/role, click "New", insert a crafted payload such as <svg/onload=alert('XSS')> into the "New" parameter, then save. The payload executes when the role preview is viewed. [2]

Impact

Successful exploitation allows the attacker to execute arbitrary web scripts or HTML in the context of the victim's browser. This can lead to session hijacking, cookie theft, redirection to malicious sites, or other actions under the guise of the vulnerable site. [1][2]

Mitigation

As of the available references, no official patch has been released for LavaLite 5.8.0. The GitHub issue suggests proper HTML entity encoding of output. Users should monitor for updates or apply input validation and output encoding manually. [2]