Description
Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| steedos | steedos-platform | ≤ 3.0.15-beta.47 | — |
References
- GitHub Issue #8354 issue-tracking
- https://github.com/steedos/steedos-platform product
- page_render.router.js - anonymous route copying schemaApi and data into the template technical-description
- page_view.ejs - unescaped EJS output of pageSchema and queryData inside an inline script technical-description
- VulnCheck Advisory: Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render third-party-advisory