Stored XSS in IRIS Web Application Datastore Upload

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the IRIS web application version 2.4.26 and possibly others. It occurs in the datastore upload function where user input is not properly sanitized before being displayed. Attackers can inject malicious JavaScript that executes in victims' browsers when they access affected parts of the application.

Useful 0 Not Useful 0

Detection Guidance

To detect this stored XSS vulnerability in the IRIS web application, inspect network traffic for datastore upload requests containing user-supplied input in asset names or descriptions. Check if the application reflects this input without proper sanitization in customer settings or other areas. Manually test by uploading a payload like <script>alert(1)</script> in asset fields and verify if it executes when viewing customer settings.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies or sensitive data, hijack user accounts, or take over the application if an administrator is targeted. The impact includes potential data breaches, unauthorized access, and manipulation of application behavior through malicious scripts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance risks include fines, legal penalties, and reputational damage due to compromised sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Implement strict output encoding for all user-supplied data in the IRIS web application. Use template engines to reduce errors and harden the Content Security Policy by removing unsafe-inline directives. These steps help prevent malicious JavaScript injection in asset names and descriptions.

Useful 0 Not Useful 0