CVE-2022-38790

Vulnerability

Weave GitOps Enterprise before version 0.9.0-rc.5 contains a cross-site scripting (XSS) vulnerability. The bug resides in the UI, where a malicious user can inject a javascript: link via an annotation on a GitopsCluster custom resource. This annotation is used for a dashboard link. Affected versions are all prior to 0.9.0-rc.5.

Exploitation

An attacker must have the ability to add an annotation to a GitopsCluster custom resource. By setting the annotation to a javascript: URI, when a victim user clicks on the link in the UI, the script executes with the victim's permissions. No additional privileges or user interaction beyond clicking the link is required.

Impact

Successful exploitation results in arbitrary JavaScript execution in the victim's browser session. This can lead to data theft, session hijacking, or other client-side attacks, compromising the confidentiality and integrity of the victim's data within the Weave GitOps Enterprise UI.

Mitigation

The issue is fixed in Weave GitOps Enterprise version 0.9.0-rc.5. Users should upgrade to this version or later. If upgrading is not immediately possible, restrict access to modify GitopsCluster resources to trusted users only.