REDHAT-BUG-2487073: XSS
Repository: migration-planner Priority: Medium Location: internal/handlers/validator/rules.go:11
Description: AgentStatusUpdate.CredentialUrl field is tagged validate:"url". go-playground/validator's url rule only checks RFC-3986 well-formedness, so javascript:alert(document.cookie) passes. Value is stored in Postgres and rendered as clickable link in migration-planner-ui-app inside Hybrid Cloud Console .
Security Impact:
Backend persistence gate for stored XSS in Red Hat hybrid-cloud console
Requires agent control alone, but chains with f003→f002 for any authenticated user to plant javascript: URL in another org's source
Script execution in victim's Hybrid Cloud Console session
Fix Suggestion: Parse URL at handler and reject anything whose scheme is not http or https before reaching service layer. UI should also stop rendering this field as raw href, but backend must not store malicious payload. See patches/f001.patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch f001.patch - Configuration
In the validator/handler before the service layer, parse AgentStatusUpdate.CredentialUrl and reject any value whose URL scheme is not exactly http or https (e.g., reject javascript: URLs) so malicious payloads are not stored/rendered.
migration-planner (internal/handlers/validator/rules.go:11) AgentStatusUpdate.CredentialUrl URL scheme allowlist = http,https - Configuration
Update the UI so AgentStatusUpdate.CredentialUrl is not rendered as a raw clickable href; ensure the backend only stores safe http/https links that the UI can render safely.
migration-planner-ui-app (Hybrid Cloud Console) rendering of AgentStatusUpdate.CredentialUrl = not rendered as raw href - Compensating control
Because the issue can be exploited by authenticated users across orgs (f003→f002 chain), enforce org scoping/authorization checks so one authenticated user cannot plant/affect stored XSS in another org’s migration-planner data.