Tenant name tooltips can be used for XSS
Summary
The tenant menu tooltip renders tenant names as HTML without sanitization when the sidebar is collapsed on desktop. The same names are escaped when displayed as ordinary text in the tenant menu, but that escaping does not apply to the tooltip.
If an attacker can control a tenant name, they could...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| composer | filament/filament |
>= 3.0.0, < 3.3.57 |
>= 3.3.57 |
| composer | filament/filament |
>= 4.0.0, < 4.15.2 |
>= 4.15.2 |
| composer | filament/filament |
>= 5.0.0, < 5.10.2 |
>= 5.10.2 |
Original description The description as published by the source.
The tenant menu tooltip renders tenant names as HTML without sanitization when the sidebar is collapsed on desktop. The same names are escaped when displayed as ordinary text in the tenant menu, but that escaping does not apply to the tooltip.
If an attacker can control a tenant name, they could store malicious HTML and execute JavaScript in the application's origin when another user accesses that tenant and triggers the tooltip. This issue only affects panels with tenancy and a collapsible desktop sidebar enabled. The victim must have access to the maliciously named tenant.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY filamentphp/filament