Tenant name tooltips can be used for XSS
Résumé
The tenant menu tooltip renders tenant names as HTML without sanitization when the sidebar is collapsed on desktop. The same names are escaped when displayed as ordinary text in the tenant menu, but that escaping does not apply to the tooltip.
If an attacker can control a tenant name, they could...
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| composer | filament/filament |
>= 3.0.0, < 3.3.57 |
>= 3.3.57 |
| composer | filament/filament |
>= 4.0.0, < 4.15.2 |
>= 4.15.2 |
| composer | filament/filament |
>= 5.0.0, < 5.10.2 |
>= 5.10.2 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
The tenant menu tooltip renders tenant names as HTML without sanitization when the sidebar is collapsed on desktop. The same names are escaped when displayed as ordinary text in the tenant menu, but that escaping does not apply to the tooltip.
If an attacker can control a tenant name, they could store malicious HTML and execute JavaScript in the application's origin when another user accesses that tenant and triggers the tooltip. This issue only affects panels with tenancy and a collapsible desktop sidebar enabled. The victim must have access to the maliciously named tenant.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
Références
- GITHUB_REPO_ADVISORY filamentphp/filament