CVE-2024-35224: Stored Cross-Site Scripting (XSS) in OpenProject
OpenProject is the leading open source project management software. OpenProject utilizes tablesorter inside of the Cost Report feature. This dependency, when misconfigured, can lead to Stored XSS via {icon} substitution in table header values. This attack requires the permissions "Edit work packages" as well as "Add attachments". A project admin could attempt to escalate their privileges by sending this XSS to a System Admin. Otherwise, if a full System Admin is required, then this attack is significantly less impactful. By utilizing a ticket's attachment, you can store javascript in the application itself and bypass the application's CSP policy to achieve Stored XSS. This vulnerability has been patched in version(s) 14.1.0, 14.0.2 and 13.4.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35224?
CVE-2024-35224 is rated as a medium severity vulnerability due to the potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2024-35224?
To fix CVE-2024-35224, ensure that the `tablesorter` configuration is correctly set up to sanitize user input in table header values.
Which versions of OpenProject are affected by CVE-2024-35224?
CVE-2024-35224 affects OpenProject versions between 13.4.2 and 14.1.0.
What is the nature of the vulnerability in CVE-2024-35224?
CVE-2024-35224 is a stored XSS vulnerability that can be exploited through improper handling of user-substituted values in table headers.
What types of attacks can result from CVE-2024-35224?
Successful exploitation of CVE-2024-35224 can allow attackers to execute arbitrary scripts in the context of the user's browser.