Executive Summary

Akaunting version 3.1.21 contains a stored cross-site scripting (XSS) vulnerability in the delete confirmation modal.

An authenticated user with permission to create or modify records can inject malicious HTML or JavaScript into a record name.

When another user opens the delete confirmation dialog for that record, the application renders the stored name as HTML using Vue's v-html, allowing the attacker's script to execute in the victim's browser.

This happens because user-controlled input is not properly validated or escaped before being stored or displayed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute malicious scripts in the browsers of other users who open the affected delete confirmation dialog.

Such script execution can lead to unauthorized actions, theft of session tokens, or other malicious activities performed on behalf of the victim user.

Because the attacker needs authenticated access with permissions to create or modify records, the impact is limited to users with such privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if the Akaunting 3.1.21 application is in use and if authenticated users with permission to create or modify records can inject HTML or JavaScript into record names.

Since the vulnerability involves stored cross-site scripting in the delete confirmation modal, detection involves checking for malicious scripts in record names that appear in the delete confirmation dialog.

There are no specific commands provided in the available resources to detect this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

As of the disclosure date, there is no available patch for this vulnerability.

Immediate mitigation steps include restricting permissions so that only trusted users can create or modify records, thereby limiting the ability to inject malicious scripts.

Additionally, users should be cautious when interacting with the delete confirmation modal, especially when deleting records created or modified by others.

Useful 0 Not Useful 0