GHSA-c8qc-wf67-342w: XSS
Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and supplier detail pages, stored manufacturer or supplier names are passed into affected table components as that name value. The client-side JavaScript later reads the browser-decoded data-selected-count-id, uses it as a selector, and concatenates countId.substring(1) directly into an HTML string passed to jQuery .after().
Affected commit:
b224cc636c6780386e3f73f03d1171f52ab4c37a
Example payload for a manufacturer or supplier name: x[foo="><svg/onload=alert(1)>"]>
The issue appears to involve the following flow:
Stored supplier/manufacturer name -> table component data-selected-count-id -> browser decodes the attribute -> JavaScript reads countId -> countId is used as a selector -> countId.substring(1) is concatenated into HTML -> jQuery .after() inserts attacker-controlled markup -> JavaScript executes in the victim's browser
Potential impact includes arbitrary JavaScript execution in the browser of an authenticated Snipe-IT user who views the affected supplier or manufacturer detail page. If the victim has elevated privileges, this may allow access to data or actions available to that user's session.
Patches Patched in https://github.com/grokability/snipe-it/commit/d12ad3d53869443b96b663ba3ce2673ef343da71
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Upgrade
Upgrade
grokability/snipe-itto a version that resolves this vulnerability.Patch d12ad3d53869443b96b663ba3ce2673ef343da71
Event History
Frequently Asked Questions
Who can exploit this issue and who is exposed?
An attacker needs the ability to store a crafted manufacturer or supplier name. Authenticated Snipe-IT users who later view the affected manufacturer or supplier detail page are exposed, with greater potential impact when the viewer has elevated privileges.
What input reaches the vulnerable browser-side HTML insertion?
Stored supplier and manufacturer names are passed as the table component name, become the data-selected-count-id attribute, and are browser-decoded before client-side JavaScript uses the value. The value is ultimately concatenated into HTML passed to jQuery .after(), allowing attacker-controlled markup to execute.
How can we check whether our deployment contains the affected code?
Check whether the deployment includes commit b224cc636c6780386e3f73f03d1171f52ab4c37a, which is identified as affected. The references also identify commit d12ad3d53869443b96b663ba3ce2673ef343da71 and release v8.6.2.