Tenant name tooltips can be used for XSS
概要
The tenant menu tooltip renders tenant names as HTML without sanitization when the sidebar is collapsed on desktop. The same names are escaped when displayed as ordinary text in the tenant menu, but that escaping does not apply to the tooltip.
If an attacker can control a tenant name, they could...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| composer | filament/filament |
>= 3.0.0, < 3.3.57 |
>= 3.3.57 |
| composer | filament/filament |
>= 4.0.0, < 4.15.2 |
>= 4.15.2 |
| composer | filament/filament |
>= 5.0.0, < 5.10.2 |
>= 5.10.2 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The tenant menu tooltip renders tenant names as HTML without sanitization when the sidebar is collapsed on desktop. The same names are escaped when displayed as ordinary text in the tenant menu, but that escaping does not apply to the tooltip.
If an attacker can control a tenant name, they could store malicious HTML and execute JavaScript in the application's origin when another user accesses that tenant and triggers the tooltip. This issue only affects panels with tenancy and a collapsible desktop sidebar enabled. The victim must have access to the maliciously named tenant.
出典: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
参照URL
- GITHUB_REPO_ADVISORY filamentphp/filament