OpenPanel XSS via Unauthenticated Favicon Proxy Endpoint

Executive Summary

This is an unauthenticated cross-site scripting (XSS) vulnerability in OpenPanel versions before 2.3.0. It exists in the GET /misc/favicon endpoint which fetches external URLs. Attackers can host malicious SVG files with embedded scripts. When a victim accesses the proxy endpoint, the SVG is served raw and the embedded script executes in the victim's browser on the API origin. This allows same-origin credentialed requests to authenticated endpoints.

The vulnerability is classified under CWE-79 (improper neutralization of input during web page generation). It affects versions 2.2.0 and earlier, with a patched version available in 2.3.0.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your OpenPanel instance is running a version before 2.3.0. You can verify the version by running commands like curl -s http://localhost:8000/version or checking the installed package version via your system's package manager. Additionally, monitor network traffic for requests to the /misc/favicon endpoint with SVG file URLs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to theft of sensitive data or unauthorized actions on behalf of the victim. Attackers can execute malicious scripts in the victim's browser, enabling same-origin requests to authenticated endpoints like /trpc and /oauth. This could result in session hijacking, data exfiltration, or manipulation of user accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information. The XSS flaw allows attackers to execute scripts in user browsers, potentially stealing credentials or session tokens to access authenticated endpoints.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenPanel to version 2.3.0 or later. If upgrading is not possible, apply mitigations such as rasterizing SVG files using Sharp, sanitizing SVG content with DOMPurify, or serving files with secure headers like Content-Disposition: attachment and Content-Security-Policy.

Useful 0 Not Useful 0