Stored XSS in Kestra Flow Description via Custom Markdown Link Syntax

Executive Summary

Kestra is an open-source orchestration platform. A vulnerability in versions before 1.3.24 allows users with permission to create or update Flow descriptions to inject JavaScript event-handler attributes via a custom Markdown link syntax. This can lead to stored cross-site scripting when other users view the description.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves stored XSS in Kestra's Flow descriptions via custom Markdown link syntax. To detect it, inspect Flow descriptions for JavaScript event-handler attributes like onclick or onerror in [[link]] syntax. Check Kestra UI for suspicious scripts in Flow descriptions or information panels.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow an attacker to execute malicious JavaScript in the context of another user's session. This may lead to unauthorized actions, data theft, or session hijacking when users view affected Flow descriptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR (data protection) or HIPAA (health information security) by enabling unauthorized access to sensitive data through cross-site scripting attacks. Organizations must address this to maintain regulatory compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kestra to version 1.3.24 or later to patch the vulnerability. Review and remove any existing Flow descriptions containing suspicious JavaScript event-handler attributes. Restrict permissions for creating or updating Flow descriptions to trusted users only.

Useful 0 Not Useful 0