CVE-2020-28364: Stored Cross-Site Scripting (XSS) in Locust
Summary
CVE-2020-28364: A stored cross-site scripting (XSS) vulnerability affects the Web UI in Locust before 1.3.2, if the installation violates the usage expectations by exposing this UI to outside users. Affects locust versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Locust is a Python-based open-source load testing tool that allows users to define user behavior using Python code. It is commonly used for testing the performance and scalability of web applications. The Locust Web UI provides a graphical interface for managing and monitoring load tests. However, versions prior to 1.3.2 are vulnerable to a stored cross-site scripting (XSS) attack if the installation is improperly exposed to outside users.
Vulnerability Detail
The stored cross-site scripting (XSS) vulnerability in Locust allows an attacker to inject malicious scripts into the Web UI, which can then be executed by unsuspecting users. This can lead to various attacks, such as stealing sensitive information, session hijacking, or delivering malware to users. The vulnerability arises when the Locust Web UI is exposed to outside users, contrary to the intended usage. This can occur if the installation is not properly secured or if access controls are misconfigured.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
pip install --upgrade "locust==1.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict access to the Locust Web UI. This can be achieved by configuring network firewalls or access controls to only allow trusted users or IP addresses to access the Web UI. Additionally, it is important to ensure that the Locust installation is not exposed to the public internet unless necessary.
Conclusion
The stored cross-site scripting (XSS) vulnerability in Locust can have serious security implications if the Web UI is exposed to outside users. It is crucial to upgrade to Locust version 1.3.2 or later to mitigate this vulnerability. Restricting access to the Web UI and ensuring proper installation security are also important measures. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for locust →
FAQ
Locust is an open-source load testing tool written in Python. It allows users to define user behavior using Python code and simulate thousands of concurrent users to test the performance and scalability of web applications.
A stored cross-site scripting (XSS) vulnerability is a type of security vulnerability that allows an attacker to inject malicious scripts into a website or web application. These scripts are then executed by unsuspecting users, potentially leading to various attacks.
The XSS vulnerability in Locust allows an attacker to inject malicious scripts into the Web UI. When users access the compromised Web UI, these scripts can be executed in their browsers, potentially leading to the theft of sensitive information, session hijacking, or the delivery of malware.
To fix the XSS vulnerability, it is recommended to upgrade to Locust version 1.3.2 or later. This version includes a fix for the vulnerability. Users should update their Locust installation by running the appropriate package manager command, such as 'pip install --upgrade locust'.
If upgrading to the latest version is not immediately feasible, a temporary workaround is to restrict access to the Locust Web UI. This can be done by configuring network firewalls or access controls to only allow trusted users or IP addresses to access the Web UI. It is also important to ensure that the Locust installation is not exposed to the public internet unless necessary.
