Stored XSS in osTicket 1.18.3

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in osTicket version 1.18.3. It occurs because user input in the thread entry title field is not properly sanitized before being stored in the database. Later, when this data is displayed in staff-facing templates, it is rendered without proper output encoding, allowing malicious JavaScript to execute in the browser of affected users.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect osTicket 1.18.3 for improperly sanitized thread entry titles. Check if user input in ticket replies or email subjects is stored without HTML escaping. Review templates where titles are rendered to confirm missing output encoding. Manual review of database entries for malicious scripts in title fields may also help.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject arbitrary JavaScript by submitting a malicious ticket reply or email with a crafted subject line. This could lead to session hijacking, defacement of the osTicket interface, theft of sensitive data, or redirection to malicious websites when staff view the affected ticket or thread.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements. If exploited, it may result in data breaches, unauthorized disclosure of protected health information, or other compliance violations depending on the data processed by osTicket.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade osTicket to a patched version if available. Implement strict input validation for thread entry titles and email subjects. Apply HTML escaping or output encoding when rendering titles in staff-facing templates. Monitor for suspicious ticket activity or unauthorized script execution.

Useful 0 Not Useful 0