TeamPass Stored Cross-site Scripting Vulnerability in nilsteampassnet/teampass
Summary
CVE-2019-17205: TeamPass Stored Cross-site Scripting. Affects nilsteampassnet/teampass versions < 2.1.27.36. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TeamPass is a password manager that allows teams to securely store and share passwords. It is designed to be user-friendly and offers features such as role-based access control and password history. However, the package nilsteampassnet/teampass is vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in TeamPass 2.1.27.36 arises from a lack of input sanitization in the username field during a login attempt. An attacker can exploit this by inserting malicious code as the username, which will be executed when an administrator views the log of failed logins. This allows the attacker to perform arbitrary actions on behalf of the administrator, potentially compromising the security of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, administrators can manually sanitize the username field before viewing the log of failed logins. This can be done by removing any suspicious or potentially malicious code from the username before processing the log. However, this is not a foolproof solution and should only be used until the package is updated with a permanent fix.
Conclusion
The stored cross-site scripting vulnerability in TeamPass can pose a significant risk to the security of the system. It is crucial to update to a patched version of the package as soon as possible to mitigate the risk of exploitation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nilsteampassnet/teampass →
FAQ
The stored XSS vulnerability in TeamPass can allow an attacker to execute arbitrary code in the context of an administrator, potentially leading to unauthorized actions and data exposure.
You can use the Vulert Playground at Vulert Scanner to check if your version of TeamPass is affected by this vulnerability. Simply enter the package name and version to get real-time information on any vulnerabilities.
At the time of this report, there are no known public exploits specifically targeting this vulnerability in TeamPass. However, it is important to address the vulnerability promptly to mitigate the risk of potential exploits.
No, this vulnerability requires an attacker to have access to the administrator's log of failed logins in order to execute the stored XSS payload. It cannot be exploited remotely without first gaining access to the system.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for nilsteampassnet/teampass.
