Stored XSS in GazellePW Donor Avatar Tooltip

Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in GazellePW (GazellePosterWall). It allows remote authenticated users to inject arbitrary JavaScript code via the avatar_mouse_over_text parameter. The injected script is stored on the server and later rendered in avatar tooltips when viewed by other users.

Useful 0 Not Useful 0

Detection Guidance

To detect this Stored XSS vulnerability in GazellePW, inspect HTTP requests and responses for the avatar_mouse_over_text parameter. Look for user-controlled input containing JavaScript code in tooltip text. Check server logs for suspicious avatar_mouse_over_text values. Manually test by submitting avatar_mouse_over_text with a simple XSS payload like <script>alert(1)</script> and verify if it executes when hovering over the avatar.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute malicious JavaScript in the browsers of other users who view the affected avatar tooltip. This could lead to session hijacking, theft of sensitive data, or defacement of the website.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized JavaScript execution through stored XSS. This may lead to data exfiltration, manipulation of user interfaces, or other malicious activities that compromise data integrity and confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GazellePW to the latest commit or patch that fixes the avatar_mouse_over_text parameter handling. Implement strict input validation to sanitize and escape all user-provided data in the avatar_mouse_over_text field. Use Content Security Policy (CSP) headers to mitigate XSS impact. Temporarily disable the avatar mouse-over text feature if an update is not immediately available.

Useful 0 Not Useful 0