REDHAT-BUG-2572952: XSS
A reflected cross-site scripting (XSS) flaw was found in Quay's v1 registry API. The util/http.py abort() helper builds error bodies with json.dumps() without setting a Content-Type, so Flask serves them as text/html. The v1 image endpoints (endpoints/v1/registry.py) interpolate the attacker-controlled imageid URL path segment into the 404 error message, and json.dumps does not escape angle brackets. An unauthenticated attacker can craft a URL that, when visited by a logged-in Quay user, executes arbitrary JavaScript in the registry origin, which is shared with the Quay web UI and API. Exploitation requires the victim's browser to first establish a v1 session cookie on a public repository (anonymous access is enabled by default), which an attacker page can chain via successive navigations. Confirmed in Quay 3.18.2; util/http.py is unchanged in current upstream main.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Logged-in Quay users who can be induced to visit a crafted v1 registry API URL are exposed. The affected registry origin is shared with the Quay web UI and API, so script execution occurs in that trusted origin.
Does exploitation require authentication or a non-default setup?
The attacker does not need to authenticate. Exploitation depends on the victim browser first obtaining a v1 session cookie for a public repository; anonymous access to public repositories is enabled by default, and an attacker can chain the required browser navigations.
What attacker-controlled input reaches the vulnerable response?
The image_id URL path segment in v1 image endpoints is included in a 404 error message. Because the error body can be served as text/html and angle brackets are not escaped, a crafted path can inject executable script.
Which version is confirmed affected?
The flaw was confirmed in Quay 3.18.2. The affected util/http.py behavior is also stated to be unchanged in current upstream main.