Cross-site Scripting (XSS) - Stored in appwrite/appwrite

Vulnerability

Overview

CVE-2022-2925 is a stored cross-site scripting (XSS) vulnerability in Appwrite, an open-source development platform that provides backend infrastructure for web, mobile, and AI applications [1]. The vulnerability affects versions prior to 1.0.0-RC1 and was fixed in a commit that updated the code.js file [3]. Stored XSS occurs when user-supplied input is not properly sanitized before being stored and later rendered to other users [4].

Exploitation

An attacker can exploit this vulnerability by submitting crafted input containing malicious JavaScript code through a vulnerable input field or endpoint [2]. The attack requires no special privileges beyond normal user access to the platform, and the injected script will be stored by the application. When other users view the affected page or content, the malicious script executes in their browser context, potentially allowing the attacker to steal session tokens, cookies, or perform actions on behalf of the victim [4].

Impact

Successful exploitation leads to unauthorized access to victim accounts, data exfiltration, or website defacement within the context of the Appwrite application [2]. Because the XSS is stored, the impact can propagate to all users who access the infected content, making it a high-severity issue that could compromise the entire application's security [4].

Mitigation

The vulnerability was patched in Appwrite version 1.0.0-RC1 [3]. Users running earlier versions should upgrade immediately to mitigate the risk. There are no known workarounds, and the fix requires updating to the patched release [4].