Time Tracker has Stored XSS vulnerability in Week View plugin

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the week view plugin of Time Tracker versions 1.22.11.5782 and prior. The issue is in the week.php file, where the $field->setTitle() method does not escape note titles before rendering them in the week view table. This allows an authenticated user to enter arbitrary JavaScript as part of a note title, which will be executed in the browser of any user viewing that week view. The vulnerable code path is triggered when rendering odd rows in the table, where the note content is used directly as a tooltip title without sanitization. This was fixed in version 1.22.12.5783 by applying htmlspecialchars to the note value before passing it to setTitle [1][2].

Exploitation

To exploit this vulnerability, an attacker must be a logged-in user with permission to add or edit notes in the time tracking system. The attacker can craft a note containing malicious JavaScript, for example ``. When any user (including administrators) subsequently loads the week view, the note is displayed in the table, and the unsanitized title attribute triggers execution of the injected script in the context of the victim's session. No additional user interaction beyond viewing the week view is required [2].

Impact

Successful exploitation permits persistent execution of arbitrary JavaScript in the context of the victim's browser session. This can lead to theft of session cookies, exfiltration of sensitive data displayed on the page, or further actions such as modifying time entries or performing actions on behalf of the victim. The attack is stored, meaning the malicious payload remains in the system and affects all subsequent viewers until the note is removed or the application is patched [2].

Mitigation

The vulnerability is fixed in Time Tracker version 1.22.12.5783, released on May 9, 2023. Users should upgrade to this version immediately. As a workaround, administrators can manually apply the fix by modifying week.php line 245 to use htmlspecialchars when calling $field->setTitle(): $field->setTitle(htmlspecialchars($table->getValueAt($row,$column)['note'])); [1][2]. No CISA KEV listing has been reported as of this writing.