Can you explain this vulnerability to me?

This vulnerability is a stored Cross-Site Scripting (XSS) issue in Kestra versions below 0.22. It occurs because Kestra improperly handles HTTP error responses in the "Overview" tab during execution. Malicious JavaScript code embedded in HTTP error pages can be stored and later executed within the Kestra instance when viewing the "Overview" tab. An attacker can exploit this by hosting a malicious web server that returns an HTTP error response containing JavaScript payloads, which Kestra then stores and executes. [1]

Useful 0 Not Useful 0

How can this vulnerability impact me? :

The impact of this vulnerability is the execution of arbitrary JavaScript code within the Kestra OSS instance. This can potentially compromise the system by allowing an attacker to run malicious scripts in the context of the Kestra application. The severity is rated as Moderate with a CVSS v3.1 base score of 4.2, indicating a significant confidentiality impact but no integrity or availability impact. [1]

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by creating or identifying HTTP requests made by Kestra to endpoints that return error responses containing malicious JavaScript code. A practical detection method involves setting up a test HTTP server (e.g., Nginx) configured to return an HTTP error response with embedded JavaScript payloads such as `<img src='#' onerror=alert(location.host) />`. Then, create a Kestra flow with an HTTP request task targeting this malicious endpoint. If the flow execution fails and the 'Overview' tab in Kestra executes the JavaScript payload, the vulnerability is present. Commands to test this include configuring Nginx with a custom error page and using Kestra CLI or UI to run the flow. Specific commands for Nginx might be: `error_page 504 /custom_504.html; location = /custom_504.html { root /usr/share/nginx/html; internal; }` where `custom_504.html` contains the malicious script. Then, trigger the flow in Kestra that makes a request to this endpoint and observe the 'Overview' tab for script execution. [1]

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

The immediate mitigation step is to upgrade Kestra to version 0.22.0 or later, where this stored XSS vulnerability has been fixed. Additionally, avoid executing flows that make HTTP requests to untrusted or potentially malicious endpoints that could return crafted error responses. Implement strict input validation and sanitization on HTTP responses if possible, and restrict high-privilege users from running flows that interact with untrusted external services until the patch is applied. [1]

Useful 0 Not Useful 0