Stored XSS in IRIS Web Application Custom Attributes

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the IRIS web application version 2.4.26. It occurs in the custom attributes function where user input is not properly sanitized before being displayed. Attackers can inject malicious JavaScript code that executes in victims' browsers when they access affected parts of the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this stored XSS vulnerability in the IRIS web application, inspect user-supplied input fields like asset names and descriptions for unsanitized JavaScript code. Check customer settings pages where output encoding may fail. Manually review application logs for unusual script tags or payloads in these fields.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies or sensitive data, hijack user sessions, or take over the application if an administrator is targeted. The impact includes potential data theft, unauthorized actions, or full system compromise through malicious JavaScript execution in the browser.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Failure to address it may result in compliance violations, legal penalties, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Implement strict output encoding for all user-supplied data in the IRIS application. Use template engines to enforce consistent encoding. Harden the Content Security Policy by removing unsafe-inline directives. Temporarily restrict access to customer settings until a patch is available.

Useful 0 Not Useful 0