Stored XSS in Omnispace Agora Project via Malicious Poll-Response Attachment

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Omnispace Agora Project versions before 26.10.0. Authenticated attackers can upload a poll-response attachment with a malicious filename that bypasses input sanitization. The filename is stored and later rendered in components like the dashboard controller, executing arbitrary scripts in users' browsers when they view the affected page.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded poll-response attachments with suspicious filenames in Omnispace Agora Project versions before 26.10.0. Inspect $_FILES sanitization bypass attempts and review stored filenames in components like CtrlDashboard for unexpected HTML/script content.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. Users viewing the affected page may have their browsers compromised, leading to potential data theft or unauthorized access to their accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking compliance with safeguards for electronic protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Omnispace Agora Project to version 26.10.0 or later to address the vulnerability. Review and sanitize all uploaded filenames strictly to prevent XSS payloads. Monitor for unauthorized file uploads and remove any suspicious attachments.

Useful 0 Not Useful 0