Stored Cross-Site Scripting in Frappe _user_tags Renderer

Executive Summary

This vulnerability allows an authenticated attacker to store a specially crafted tag value in the _user_tags field. When a victim opens the list or report view where these tags are displayed, the malicious tag triggers JavaScript execution. This happens because the renderer inserts tag content directly into HTML attributes and element content without properly escaping it, leading to cross-site scripting (XSS).

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of malicious tag values stored in the _user_tags field that contain injected JavaScript code. Since the attack involves storing crafted tags via the API endpoint, monitoring or querying the tags stored in the system can help identify exploitation attempts.

A practical approach is to query the _user_tags field for suspicious tag values containing JavaScript event handlers or unusual characters such as quotes and angle brackets.

• Use API or database queries to list tags stored in _user_tags and look for suspicious patterns like: xss" onmouseover="alert(7171)" z="
• Example command to query tags (assuming direct database access): SELECT _user_tags FROM <relevant_table> WHERE _user_tags LIKE '%onmouseover=%' OR _user_tags LIKE '%<script>%';
• Monitor HTTP POST requests to the API endpoint frappe.desk.doctype.tag.tag.add_tag for suspicious payloads containing JavaScript code.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to cross-site scripting attacks, allowing an attacker to execute arbitrary JavaScript in the context of a victim's browser. This can result in unauthorized actions performed on behalf of the victim, theft of sensitive information such as session tokens, or other malicious activities when the victim views the affected list or report.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include avoiding the use of the vulnerable Frappe Framework version 16.10.0 or disabling the tag rendering features that use the vulnerable Tag Pill Renderer component.

Since no patch is currently available, it is recommended to restrict access to the affected functionality and prevent attackers from injecting malicious tags by limiting authenticated user permissions.

• Disable or restrict the use of the tag rendering feature in the UI to prevent execution of injected scripts.
• Monitor and audit user inputs to the tag API endpoint to detect and block malicious tag submissions.
• Consider upgrading to a fixed version once available or applying custom input sanitization and escaping in the tag rendering logic.

Useful 0 Not Useful 0