Critical Stored XSS Vulnerability in Hackage Package Uploads
Summary
HSEC-2024-0004: Hackage package and doc upload stored XSS vulnerability. Affects hackage-server versions >= 0.1, < 0.6. Fixed in 0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hackage is a Haskell package repository that allows users to upload and share Haskell libraries and applications. It serves as a central hub for Haskell developers to access and distribute their code. The vulnerability in question affects the hackage-server, which is responsible for managing package uploads and documentation. This vulnerability allows malicious actors to exploit the upload functionality to execute scripts in users' browsers, potentially compromising user sessions and data.
Vulnerability Detail
A critical stored cross-site scripting (XSS) vulnerability was identified in the hackage-server and its documentation upload feature. This vulnerability arises from the fact that HTML and JavaScript files uploaded as part of source packages are served without proper sanitization. As a result, when users with active HTTP credentials access these maliciously crafted package pages, their sessions can be hijacked, allowing attackers to perform unauthorized actions such as uploading packages, modifying metadata, or stealing user credentials. The vulnerability was reported in June 2024 and has a CVSS score of 9.9, indicating its critical nature.
How To Fix
Minimum fixed version
0.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid accessing package documentation and source tarballs that were uploaded prior to the implementation of the mitigations. However, the best course of action is to update to the patched version of hackage-server.
Conclusion
The critical stored XSS vulnerability in the hackage-server poses significant risks to users by allowing attackers to hijack sessions and perform unauthorized actions. It is crucial for users to update to the latest version of hackage-server to mitigate these risks effectively. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for hackage-server →
FAQ
The vulnerability is a stored XSS issue that allows attackers to execute scripts in the context of a user's session.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
If exploited, this vulnerability can lead to session hijacking, unauthorized actions on behalf of users, and potential data theft.
While the best solution is to update to the patched version, users can temporarily avoid accessing potentially malicious documentation or source tarballs.
For support, you can reach out to the Haskell Security Response Team or consult the Hackage community for assistance.
References
Related vulnerabilities
Recent vulnerabilities recorded for hackage-server.
