Описание
Summary
On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a Choices or Labels tag, resulting in an XSS vulnerability.
Details
Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1.
PoC
-
Create a project.
-
Upload a file containing the payload using the "Upload Files" function.
The following are the contents of the files used in the PoC
{
"data": {
"prompt": "
Ссылки
- Patch
- Patch
- Release Notes
- ExploitVendor Advisory
- Patch
- Patch
- Release Notes
- ExploitVendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.11.0 (исключая)
cpe:2.3:a:humansignal:label_studio:*:*:*:*:*:*:*:*
EPSS
Процентиль: 80%
0.01335
Низкий
4.7 Medium
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79
CWE-79
Связанные уязвимости
CVSS3: 4.7
debian
почти 2 года назад
### Summary On all Label Studio versions prior to 1.11.0, data importe ...
CVSS3: 4.7
github
почти 2 года назад
Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config
EPSS
Процентиль: 80%
0.01335
Низкий
4.7 Medium
CVSS3
6.1 Medium
CVSS3
Дефекты
CWE-79
CWE-79