Potential XSS in book navigation

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the BlueSpiceBookshelf extension of BlueSpice. Users with a regular account and edit permissions can inject arbitrary HTML into the book navigation by editing a book chapter title. This affects BlueSpice 4.x versions prior to 4.2.1 [1].

Exploitation

An attacker must have a valid user account with edit permissions on a book. The attacker edits a chapter title to include malicious HTML or JavaScript code. The injected code is then rendered in the book navigation interface when other users view the book [1].

Impact

Successful exploitation allows the attacker to execute arbitrary HTML or JavaScript in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information. The impact is limited by the scope of the navigation component.

Mitigation

The vulnerability is fixed in BlueSpice version 4.2.1 [1]. Users should upgrade to this version or later. No workarounds are documented. The issue was discovered during an internal security audit.