Stored XSS in React-Admin via javascript: URIs in UrlField and FileField

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in react-admin versions before 5.15.5. Attackers can inject malicious javascript: URIs into record fields that use UrlField or FileField components. When an administrator clicks the rendered link in the admin interface, the injected JavaScript executes within their authenticated session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect react-admin applications using versions prior to 5.15.5. Check for UrlField and FileField components rendering javascript: URIs in record fields. Review network requests and admin interfaces for suspicious links with javascript: schemes.

Useful 0 Not Useful 0

Impact Analysis

If you use react-admin versions prior to 5.15.5, attackers with access to modify URL-type fields could inject malicious scripts. Clicking these links in the admin interface could lead to session hijacking, unauthorized actions, or data theft performed by the injected JavaScript in your authenticated session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Compliance may be impacted if user data is compromised through this exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade react-admin to version 5.15.5 or later immediately. Review and sanitize all URL-type fields in your data sources to prevent javascript: URI injection. Implement input validation for user-provided URLs.

Useful 0 Not Useful 0