Cross-site Scripting (XSS) - Stored in allegroai/clearml-server

Vulnerability

A stored Cross-site Scripting (XSS) vulnerability exists in the ClearML Server web application in versions prior to 1.13.0. An attacker can inject malicious scripts that are stored on the server and executed in the browsers of other users when they view the affected content [1][2].

Exploitation

To exploit the vulnerability, an attacker needs to have access to the ClearML Server web interface and input a crafted payload in a field that is not properly sanitized. The payload is then stored and later rendered to other users, leading to script execution in their browsers [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, data theft, or performing unauthorized actions on behalf of the victim within the ClearML Server application [2].

Mitigation

The vulnerability is fixed in ClearML Server version 1.13.0, released on December 18, 2023 [1]. Users should upgrade to this version or later. No workarounds are documented.