Stored XSS in OpenReplay Dashboard via Unsanitized Event Data

Executive Summary

This vulnerability exists in OpenReplay's tracking SDK versions from 1.24.0 before 1.25.0. The SDK accepts custom event names and captured page URLs from any visitor using a public project key and stores them in ClickHouse without output encoding. Later, these stored values are rendered in the authenticated dashboard through TextEllipsis and the event-details modal. Because of the lack of output encoding, an unauthenticated attacker can inject malicious scripts that execute in the dashboard's origin.

This script execution allows the attacker to read the session JWT token from localStorage and take over a dashboard account.

The issue is fixed in version 1.25.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to dashboard accounts. An attacker can execute malicious scripts in the dashboard context, steal session tokens (JWT) from localStorage, and take over user accounts.

Such account takeover can lead to unauthorized access to sensitive data and control over the OpenReplay dashboard, potentially compromising the security and privacy of the monitored sessions.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade OpenReplay tracking SDK to version 1.25.0 or later, where the issue is fixed.

Useful 0 Not Useful 0