Stored XSS in kagisearch smallweb via Query String Rendering

Executive Summary

This is a reflected Cross-Site Scripting (XSS) vulnerability in the kagisearch smallweb application. The flaw exists in the index() function of app/sw.py where the raw HTTP query string is captured without sanitization and passed to templates. The templates then render this query string using the |safe filter in HTML form action attributes, disabling HTML escaping. An attacker can exploit this by sending a raw HTTP request with unencoded double-quote characters and a script tag in the query string to inject and execute arbitrary JavaScript in the victim's browser.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability, inspect HTTP requests containing raw query strings with unencoded double-quote characters. Use tools like curl or netcat to send raw HTTP requests with payloads such as '?qs="<script>alert(1)</script>' to endpoints using the affected kagisearch smallweb versions. Check responses for reflected script execution in form action attributes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript code in the context of the kagi.com origin. This can lead to session hijacking, where attackers steal user session cookies or tokens. It also enables unauthorized actions such as liking, flagging, or adding notes on behalf of the victim without their consent. The attack requires a raw HTTP request, which is typically sent via tools like curl or netcat, bypassing browser auto-encoding.

Useful 0 Not Useful 0

Compliance Impact

This XSS vulnerability can lead to unauthorized access to user data, which may violate GDPR's data protection principles if personal data is exposed or modified. For HIPAA, it could compromise protected health information if such data is processed by the application. Both regulations require safeguards against unauthorized data access or modification, which this vulnerability undermines.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch from commit 00b68144e583f20a6b67e29cf01bc07f57979ffb by updating to the latest version. Alternatively, manually edit the template files (reactions.html, flag_panel.html, mobile_more.html) to replace {{ qs|safe }} with {{ qs|e }} or {{ qs|urlencode }} in form action attributes.

Useful 0 Not Useful 0