Passbolt Api E-mail HTML Injection Vulnerability
Summary
GHSA-v86m-j5f7-ccwh: Passbolt Api E-mail HTML injection. Affects passbolt/passbolt_api versions < 2.7.0. Fixed in 2.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Passbolt is an open-source password manager that sends email notifications to users for various password-related events. These emails may contain user-inputted data, such as password titles or descriptions. The Passbolt API is responsible for handling these email notifications. However, it fails to properly escape user input, allowing for HTML injection in the email content. This vulnerability can be exploited by an authenticated attacker who shares a password with an HTML img tag in its description. The impact of this vulnerability is low, as most mail user-agents do not load remote images for privacy reasons.
Vulnerability Detail
The Passbolt API fails to properly escape user input in email notifications, allowing for HTML injection. An attacker who shares a password containing an img HTML tag in its description can obtain information about the recipient's mail user-agent. While the impact of this vulnerability is low, it still poses a risk to user privacy.
How To Fix
Minimum fixed version
2.7.0
This is the first release that contains the fix.
composer require passbolt/passbolt_api:2.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, users can minimize the risk by not sharing passwords with HTML img tags in their descriptions.
Conclusion
Passbolt API is vulnerable to HTML injection in email notifications. This vulnerability has a low impact but can still pose a risk to user privacy. Users should update their Passbolt installation to version 2.7.0 or later to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for passbolt/passbolt_api →
FAQ
Passbolt is an open-source password manager that allows users to securely store and share passwords.
HTML injection is a type of vulnerability where an attacker can insert malicious HTML code into a web page or email.
The impact of this vulnerability is low, as most mail user-agents do not load remote images. However, it can still be used to obtain information about the recipient's mail user-agent.
To fix this vulnerability, update your Passbolt installation to version 2.7.0 or later.
While there is no specific workaround, you can minimize the risk by not sharing passwords with HTML img tags in their descriptions.
References
Related vulnerabilities
Recent vulnerabilities recorded for passbolt/passbolt_api.
