Stored XSS vulnerability in anuko/timetracker

Vulnerability

Anuko Time Tracker versions prior to 1.20.0.5646 contain a stored cross-site scripting (XSS) vulnerability in ttUser.class.php. The application failed to escape the primary group name using htmlspecialchars before display. A logged-in user with the ability to modify their group name could inject arbitrary JavaScript code as part of that name. This code would then be stored and executed in the browsers of other users viewing pages where the group name is rendered [1][2].

Exploitation

An attacker must be a logged-in user with the ability to change their primary group name (typically granted to group managers or admins). The attacker sets the group name to a string containing JavaScript payloads, e.g., ``. No additional privileges or user interaction beyond normal page viewing is required. When any user (including administrators) visits pages that display the group name, the injected script executes [1][2].

Impact

Successful exploitation results in stored XSS, allowing the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, data exfiltration, or other malicious actions performed under the victim's identity and privileges [2].

Mitigation

The vulnerability is fixed in version 1.20.0.5646, released in the commit 6aaad31 on 2022-02-23. Users unable to upgrade should apply the workaround: modify getUserPartForHeader in ttUser.class.php to use htmlspecialchars when printing the group name — change line 837 from $user_part .= ', '.$this->group_name; to $user_part .= ', '.htmlspecialchars($this->group_name); [1][2].