Stored XSS in Plunk Email Platform

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the Plunk email platform prior to version 0.9.0. It occurs in the campaign management feature where email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization.

Because of this, a lower-privileged member can embed malicious scripts in a campaign's email body. These scripts execute in the context of any admin or other member who views the campaign, potentially allowing session hijacking or unauthorized actions on their behalf.

The issue was fixed in version 0.9.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a lower-privileged user to inject malicious scripts into the email campaign content.

When an admin or other member views the campaign, these scripts execute in their browser context, potentially leading to session hijacking or unauthorized actions performed on their behalf.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Plunk to version 0.9.0 or later, where the stored cross-site scripting (XSS) issue in the campaign management feature has been patched.

Additionally, avoid using versions prior to 0.9.0, as they allow lower-privileged members to embed malicious scripts in email bodies that can execute in the context of admins or other members.

Useful 0 Not Useful 0