Reflected XSS in Steedos Platform via API Render Endpoint

Executive Summary

This is a reflected cross-site scripting (XSS) vulnerability in Steedos Platform through version 3.0.15-beta.47. The issue occurs in the anonymous /api/page/render endpoint where query parameters like schemaApi or data are not properly escaped when inserted into inline script elements. Attackers can craft malicious links containing script-terminating sequences to break out of the script context and inject arbitrary JavaScript code.

Useful 0 Not Useful 0

Detection Guidance

To detect this reflected XSS vulnerability, monitor HTTP requests to the /api/page/render endpoint for unusual query parameters like schemaApi or data containing script tags or sequences like </script>. Use tools like Burp Suite or OWASP ZAP to intercept and inspect these parameters for unescaped content. Check server logs for requests with payloads such as </script><script>alert(1)</script> in these parameters.

Useful 0 Not Useful 0

Impact Analysis

An attacker can execute arbitrary JavaScript in victim sessions by tricking users into clicking a malicious link. This could lead to theft of sensitive credentials like X-Auth-Token, session hijacking, or performing unauthorized actions on behalf of the victim. Since the endpoint is accessible without authentication, any user visiting a crafted link could be affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If credentials or personal data are stolen, it may result in non-compliance with data protection regulations, potentially leading to legal penalties and reputational damage for organizations using the affected platform.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Steedos Platform to a patched version if available. If not, implement input validation and output encoding for the schemaApi and data parameters in the /api/page/render endpoint. Add Content-Security-Policy headers to restrict inline scripts. Temporarily disable anonymous access to the endpoint if possible until a fix is applied.

Useful 0 Not Useful 0