Cross-site Scripting (XSS) - Stored in answerdev/answer

Vulnerability

Overview

CVE-2023-1244 is a stored cross-site scripting (XSS) vulnerability in the Answer Q&A platform, affecting versions prior to 1.0.6. The root cause is insufficient sanitization of the site_name input during the initial setup process. The commit that fixes the issue adds a custom sanitizer validation tag to the SiteName field, indicating that user-supplied HTML or JavaScript was not being properly filtered before storage [1][3].

Exploitation

An attacker with access to the initial setup interface (or any subsequent administrative interface that allows modifying the site name) can inject malicious scripts into the site_name parameter. Because the input is stored and later rendered on pages throughout the application, the XSS is persistent. No authentication is required if the attacker can trigger the setup flow, but in practice, exploitation typically requires administrative privileges or a misconfiguration that exposes the setup endpoint [2][4].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who views a page containing the injected site name. This can lead to session hijacking, defacement, or theft of sensitive data. The vulnerability is classified as stored XSS, which is generally considered high severity because the malicious payload persists and affects multiple users without requiring additional interaction [1][4].

Mitigation

The issue was patched in Answer version 1.0.6 by adding input sanitization to the site_name field. Users should upgrade to the latest version immediately. No workarounds are documented, but restricting access to the setup and administrative interfaces can reduce the attack surface [2][3].