Reflected XSS in Quay Container Registry

Executive Summary

This is a DOM-based cross-site scripting (XSS) vulnerability in Red Hat Quay's OAuth callback handler. It allows a remote attacker to execute arbitrary JavaScript in a user's browser by tricking them into clicking a specially crafted link. The flaw occurs due to improper input sanitization when the format=json parameter is used, enabling malicious code execution within the Quay registry's origin.

Useful 0 Not Useful 0

Detection Guidance

To detect this XSS vulnerability in Quay, monitor network traffic for suspicious OAuth callback requests containing the format=json parameter. Check browser logs or proxy logs for URLs with malicious JavaScript payloads in the fragment or access_token values. Inspect Quay server logs for unusual activity during OAuth flows.

Useful 0 Not Useful 0

Impact Analysis

An attacker could compromise your Quay session, access sensitive registry data, or perform unauthorized actions on your behalf. This requires you to click a malicious link while logged into Quay. The attack bypasses OAuth state validation and does not need authentication to exploit.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compromised user sessions may expose regulated data, requiring breach notifications and compliance investigations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling the affected OAuth local callback handler if possible, implementing strict input validation for the format=json parameter, and updating Quay to a patched version if available. Since Red Hat states mitigation options are unavailable, consider restricting access to the OAuth callback endpoint or using a web application firewall to block malicious payloads.

Useful 0 Not Useful 0