CVE-2021-32091: Cross-site scripting (XSS) vulnerability in StackLift LocalStack 0.12.6
Summary
CVE-2021-32091: A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6. Affects localstack versions < 0.12.6.1. Fixed in 0.12.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
StackLift LocalStack is a package available on PyPI that provides a local AWS cloud stack for testing and development purposes. It allows users to emulate various AWS services locally, enabling them to develop and test their applications without incurring any costs. However, version 0.12.6 of LocalStack is vulnerable to a Cross-site scripting (XSS) attack.
Vulnerability Detail
The Cross-site scripting (XSS) vulnerability in StackLift LocalStack 0.12.6 allows an attacker to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the affected user's browser, potentially compromising their sensitive information or performing unauthorized actions on their behalf. The vulnerability originates from improper input validation and sanitization of user-supplied data, which allows the attacker to inject malicious code that is executed by the victim's browser.
How To Fix
Minimum fixed version
0.12.6.1
This is the first release that contains the fix.
pip install --upgrade "localstack==0.12.6.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on their own, ensuring that user-supplied data is properly handled and does not contain any malicious code. Here is an example of how to sanitize user input in Python:
import html
user_input = '<script>alert("XSS attack!")</script>' sanitized_input = html.escape(user_input)
By using the html.escape() function, any HTML special characters in the user input are replaced with their corresponding HTML entities, preventing the execution of scripts.
Conclusion
In conclusion, the Cross-site scripting (XSS) vulnerability in StackLift LocalStack 0.12.6 can lead to the execution of arbitrary code in the victim's browser. It is crucial to upgrade to version 0.12.6.1 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for localstack →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the victim's browser, potentially compromising their sensitive information or performing unauthorized actions on their behalf.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this XSS vulnerability in LocalStack.
Yes, upgrading to version 0.12.6.1 or later of LocalStack fixes this vulnerability by implementing proper input validation and sanitization.
As a temporary workaround, you can implement input validation and sanitization on your own to prevent the execution of malicious scripts.
You can find more information about this vulnerability in the advisory database maintained by PyPA at https://github.com/pypa/advisory-database/blob/main/vulns/localstack/PYSEC-2021-102.yaml
Related vulnerabilities
Recent vulnerabilities recorded for localstack.
