Stored XSS in Zipline File Viewer via Unescaped Embed Settings

Executive Summary

Zipline versions 4.3.0 to 4.5.0 have a stored cross-site scripting (XSS) vulnerability. Authenticated low-privilege users can inject malicious HTML by setting unescaped embed settings in SSR meta tags. This is done by modifying embedTitle, embedDescription, embedSiteName, or embedColor values via a PATCH request to /api/user. When other users view the attacker's file pages, the injected JavaScript executes in their browsers.

Useful 0 Not Useful 0

Detection Guidance

Check for Zipline versions between 4.3.0 and 4.5.0. Inspect user PATCH requests to /api/user for unescaped embed settings like embedTitle, embedDescription, embedSiteName, or embedColor. Look for HTML or JavaScript injection in file view pages.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. Users with low privileges can escalate attacks to compromise higher-privilege accounts or data. The impact depends on user permissions and the sensitivity of accessed files.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A successful XSS attack could lead to data breaches, resulting in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to version 4.5.0 or later. Apply input validation and output encoding for embed settings. Restrict low-privilege user permissions to prevent unauthorized PATCH requests.

Useful 0 Not Useful 0