Rucio WebUI Vulnerable to Stored Cross-site Scripting (XSS) through Custom Rule Function

Vulnerability

Rucio, a scientific data management framework, contains a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of its WebUI. The root cause is that attacker-controlled input, specifically in the comment field when creating a rule, is persisted by the backend without proper output encoding. When the rule is later viewed or approved, the stored script executes in the WebUI origin [2][3].

Exploitation

Exploitation

An authenticated user can inject a malicious payload into the comment field during rule creation (e.g., via POST /proxy/rules/). The payload is stored and later rendered without sanitization. The script triggers when any user views the rule (e.g., via Monitoring > Subscriptions and Rules > Show My Rules) or when an administrator approves it (Data Transfer > Approve Rules). No special privileges beyond standard authentication are required to create the malicious rule [3].

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the WebUI for any user viewing the affected page. This can lead to session token theft (if cookies lack HttpOnly flag) or unauthorized actions performed on behalf of the victim. The impact is amplified by API tokens exposed to the WebUI via JavaScript variables [3].

Mitigation

The vulnerability is fixed in Rucio versions 35.8.3, 38.5.4, and 39.3.1. Users should upgrade to these patched versions. The OWASP XSS Prevention Cheat Sheet provides general guidance on preventing such issues through proper output encoding and framework security practices [1][2].