Stored XSS in Cachet Status Page System

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Cachet versions 2.4.1 and earlier. An authenticated attacker can inject malicious HTML or JavaScript into the incident creation form. When other users view the status page, the injected code executes in their browsers, potentially stealing session tokens or enabling account takeover.

Useful 0 Not Useful 0

Detection Guidance

To detect this stored XSS vulnerability in Cachet, inspect incident creation forms for improperly sanitized HTML input. Check if user-authored Markdown content renders raw HTML or unsafe links. Review server logs for suspicious script execution patterns in status page views.

Useful 0 Not Useful 0

Impact Analysis

If you use Cachet for your status page, an attacker could steal your session cookies or tokens, redirect you to malicious pages, or take over your account. This requires the attacker to have content creation permissions but could affect all visitors to your status page.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. It may result in data breaches, non-compliance penalties, and loss of trust in systems handling sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the security patches from commits 57b44a8 and 23adbb8 in cachethq/core. Ensure all user-authored Markdown content is processed through the new Cachet::markdown() method which strips raw HTML and unsafe links. Disable incident creation for non-trusted users until patched.

Useful 0 Not Useful 0