Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

Vulnerability

Description A reflected Cross-Site Scripting (XSS) vulnerability exists in Rucio WebUI versions prior to 35.8.3, 38.5.4, and 39.3.1 [2]. The root cause is that the server error response includes the ExceptionMessage, which may contain user-controlled input, and the WebUI client renders this message into the DOM without proper encoding, using unsafe methods like jQuery's .html() [3]. This allows an attacker to inject arbitrary HTML and JavaScript.

Exploitation

An attacker can craft a malicious URL (e.g., https://host/ui/account_rse_usage?account=...) that triggers a 500 error. The server includes the attacker's input in the ExceptionMessage, and when the WebUI displays it, the injected script executes in the context of the victim's browser [3]. No authentication is required to trigger the error; the victim only needs to visit the crafted link while authenticated to Rucio.

Impact

Successful exploitation enables an attacker to steal the victim's login session token (cookie) [2]. With this token, the attacker can impersonate the victim and gain unauthorized access to Rucio resources, potentially compromising sensitive scientific data.

Mitigation

The issue is fixed in Rucio versions 35.8.3, 38.5.4, and 39.3.1 [2]. Users should upgrade to one of these versions as soon as possible.