`osctrl-admin` has Stored Cross-Site Scripting (XSS) in On-Demand Query List

Overview

A stored Cross-Site Scripting (XSS) vulnerability in osctrl, an osquery management solution, allows an authenticated user with query-level permissions to inject arbitrary JavaScript into the query parameter of an on-demand query. The payload is stored server-side and executes in the browser of any user, including administrators, who views the on-demand query list page. This issue affects all versions prior to v0.5.0 [2][4].

Exploitation

An attacker with the lowest privilege tier (query-level permissions) can craft an on-demand query containing malicious JavaScript. The payload is stored and triggers when any user visits the query list interface. No additional authentication or network position is required beyond having query permissions. The stored nature of the XSS means the payload persists and affects users across sessions [2][4].

Impact

The injected JavaScript executes in the context of the victim's session, enabling CSRF token extraction. An attacker can then perform actions as the logged-in user, including privilege escalation. If an administrator views the malicious query list, a full compromise of the osctrl platform is possible, allowing unauthorized management of osquery endpoints and sensitive data access [2][4].

Mitigation

The vulnerability is patched in osctrl v0.5.0. Users should upgrade immediately. As a workaround, restrict query-level permissions to trusted users, monitor the query list for suspicious payloads, and review user accounts for unauthorized administrators [2][4].