Rucio WebUI has a Stored Cross-site Scripting (XSS) Vulnerability in its Custom RSE Attribute

Vulnerability

Description Rucio versions prior to 35.8.3, 38.5.4, and 39.3.1 contain a stored Cross-Site Scripting (XSS) vulnerability in the Custom RSE Attribute functionality of the WebUI [2]. The underlying issue is that attacker-controlled input provided via the 'Add Attribute' feature is persisted by the backend and later rendered on the RSE view page without proper output encoding [3]. This type of injection vulnerability is well-documented in the OWASP Cross-Site Scripting Prevention Cheat Sheet, which recommends output encoding and framework-specific protections [1].

Exploitation

Path An authenticated attacker can inject a malicious JavaScript payload by sending a POST request to /proxy/rses/WEB1/attr/XSS with a crafted value such as `` [3]. The payload is stored in the custom RSE attribute and triggers every time any user views the RSE in the Admin > RSE Management section [3]. No special privileges beyond having an account that can add attributes are required; any authenticated user who views the affected page becomes a victim of the XSS attack.

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the WebUI origin. This can lead to session token theft if session cookies lack the HttpOnly flag, or are otherwise accessible to JavaScript, API token exfiltration, or unauthorized administrative actions on behalf of the victim [3]. Attackers can perform operations such as creating new UserPass identities with known passwords, adding or deleting RSEs, or exfiltrating scientific data metadata [3].

Mitigation

The vulnerability is fixed in Rucio versions 35.8.3, 38.5.4, and 39.3.1 [2]. Users should upgrade to the latest patched version of their release line. The Rucio project also recommends reviewing session cookie Http flags and API token exposure in WebUI JavaScript variables as additional hardening measures [3].