Stored XSS in Roskus Prospero Flow CRM Email Module

Executive Summary

This is a Stored Cross-site Scripting (XSS) vulnerability in Roskus Prospero Flow CRM before version 5.4.4. A remote, authenticated low-privileged user can inject malicious JavaScript into an email body. When another user, including administrators, opens the email, the script executes in their browser without proper sanitization or escaping.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the email module in Roskus Prospero Flow CRM for unescaped rendering of email body content. Check if the application uses {!! $email->body !!} without proper sanitization. Review stored emails for suspicious JavaScript payloads in the body.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, leading to account takeover. They might also perform actions on behalf of the victim, access sensitive data, or escalate privileges to gain full control of the CRM system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information, risking compliance with safeguards for electronic protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Roskus Prospero Flow CRM to version 5.4.4 or later. If upgrading is not possible, apply input validation and output encoding to sanitize email body content before rendering. Restrict low-privileged users from sending emails with scripts.

Useful 0 Not Useful 0