Passbolt API XSS Vulnerability
Summary
CVE-2017-1000442: Passbolt API is vulnerable to XSS in the url field on the password workspace grid and sidebar. Affects passbolt/passbolt_api versions < 1.6.5. Fixed in 1.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Passbolt API is a package available on Packagist that provides password management functionality. It allows users to securely store and share passwords within a workspace. The package is vulnerable to a cross-site scripting (XSS) attack in the url field on the password workspace grid and sidebar.
Vulnerability Detail
The XSS vulnerability in Passbolt API version 1.6.4 and older allows an attacker to inject malicious code into the url field. This can lead to the execution of arbitrary JavaScript code in the context of other users who view the affected workspace. The impact of this vulnerability can range from unauthorized access to sensitive information to potential remote code execution.
How To Fix
Minimum fixed version
1.6.5
This is the first release that contains the fix.
composer require passbolt/passbolt_api:1.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to sanitize user input in the url field. This can be done by implementing input validation and escaping techniques to prevent the execution of JavaScript code. Here is an example of how to sanitize user input in PHP:
$url = $_POST['url'];
$sanitizedUrl = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
Conclusion
The Passbolt API XSS vulnerability allows for the injection of malicious code in the url field, potentially leading to unauthorized access or remote code execution. It is crucial to upgrade to version 1.6.5 or newer to mitigate this vulnerability. If you need further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for passbolt/passbolt_api →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other users, potentially leading to unauthorized access to sensitive information or remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and it will provide real-time alerts for open-source vulnerabilities.
Yes, upgrading Passbolt API to version 1.6.5 or newer will fix this vulnerability. It is recommended to update the package as soon as possible.
Yes, you can sanitize user input in the url field to prevent the execution of JavaScript code. Implement input validation and escaping techniques to ensure the input is safe.
For more information about this vulnerability, you can refer to the Passbolt API advisory on the GitHub Advisory Database: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for passbolt/passbolt_api.
