JavaScript URI XSS in Dashy RSS Widget

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in the Dashy application affecting versions 1.9.4 to 3.1.2. The RSS Widget does not sanitize RSS item link values before rendering them as anchor href attributes. An attacker controlling a subscribed RSS feed can inject a malicious javascript: URI, which executes arbitrary JavaScript in a victim's browser when clicked.

Useful 0 Not Useful 0

Detection Guidance

Check if your Dashy instance is running a vulnerable version (1.9.4 to 3.1.2) by inspecting the version in the application or logs. Look for RSS feeds using the default rss2json mode in the RSS Widget configuration. Manually test by subscribing to a feed with a javascript: URI in the link field and observing if it executes when clicked.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to execute arbitrary JavaScript in your browser when you click a malicious link in the Dashy RSS feed. This could lead to session token theft, credential exfiltration, or other actions performed under the Dashy origin. User interaction is required for the exploit to work.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling session token theft, credential exfiltration, or other malicious actions under the Dashy origin. If an attacker exploits this to steal user credentials or session tokens, it may lead to unauthorized access to personal data, violating GDPR's data protection principles or HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dashy to version 3.2.0 or later immediately. If upgrading is not possible, disable the RSS Widget or avoid using the rss2json mode. Review and sanitize any RSS feeds before subscribing to prevent malicious javascript: URIs. Monitor network traffic for unusual activity from Dashy.

Useful 0 Not Useful 0