Cross-Site Scripting (XSS) in ELADMIN via WebSocketServer and SpringSecurityConfig

Executive Summary

This vulnerability is a Cross Site Scripting (XSS) flaw in ELADMIN versions 2.7 and earlier. It exists in the WebSocketServer, SpringSecurityConfig, and deploy.vue components. An unauthenticated WebSocket endpoint rebroadcasts client-supplied frames without sanitization. When an administrator views the deployment page, the page renders the message content as HTML, allowing an attacker to inject malicious scripts that execute in the administrator's browser.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in ELADMIN v2.7 or earlier, monitor WebSocket traffic on the `/webSocket/**` endpoints. Check for unauthenticated connections to `/webSocket/TARGET_SESSION` and inspect messages containing HTML or script tags. Use network tools like Wireshark or tcpdump to capture WebSocket frames. Inspect the deployment page (`deploy.vue`) for `dangerouslyUseHTMLString: true` usage.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure or unauthorized actions within the victim's authenticated context. An attacker could steal session cookies, perform actions on behalf of the administrator, or access sensitive data. The impact is significant because it allows remote code execution in the context of an authenticated administrator.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can compromise data confidentiality and integrity, which are key requirements under GDPR and HIPAA. It may lead to unauthorized access to personal or protected health information, resulting in non-compliance with these regulations. Organizations using affected ELADMIN versions could face legal and financial penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ELADMIN to a version beyond 2.7 to address the vulnerability. Disable unauthenticated WebSocket handshakes by restricting `/webSocket/**` paths in Spring Security. Sanitize all WebSocket messages before broadcasting. Replace `dangerouslyUseHTMLString: true` with safe rendering methods in `deploy.vue`.

Useful 0 Not Useful 0