Stored XSS in Zipline File Viewer via Unescaped HighlightCode

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Zipline versions before 4.5.1. The HighlightCode component renders user-uploaded file content without proper HTML escaping before highlight.js loads. Attackers can upload malicious text files containing JavaScript payloads. When other users view these files, the payload executes in their browsers, enabling actions like API calls on their behalf.

Useful 0 Not Useful 0

Detection Guidance

Check if Zipline is installed and its version. Run commands like 'npm list zipline' or 'zipline --version' to verify if the version is below 4.5.1. Inspect uploaded text files for suspicious HTML/JavaScript content, especially those with payloads that may execute before highlight.js loads.

• Use network monitoring tools to detect unusual API calls or data exfiltration attempts from user sessions viewing files.

Useful 0 Not Useful 0

Impact Analysis

If you use Zipline before 4.5.1, an authenticated attacker could upload a malicious file. When you view it, the embedded script could steal your session tokens, make unauthorized API requests, or exfiltrate data from your account. This could lead to account takeover or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, fines, or legal consequences if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to version 4.5.1 or later immediately. Remove or restrict access to uploaded text files containing suspicious content until the upgrade is complete. Monitor for unauthorized API calls or data access.

Useful 0 Not Useful 0