Stored XSS in XXL-JOB Job Log List Page

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in XXL-JOB versions up to 3.5.0-SNAPSHOT. An authenticated user with permissions to a job group can inject malicious JavaScript via the executorParam parameter when manually triggering a job. The input is stored and later rendered as raw HTML in the job log list page, causing the script to execute when viewed by others.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect XXL-JOB instances running versions up to 3.5.0-SNAPSHOT. Check for suspicious manual job triggers with unusual executorParam values containing JavaScript code. Review job logs for stored XSS payloads like <script> tags or event handlers. Monitor network traffic for POST requests to /jobinfo/trigger with encoded or obfuscated parameters.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of the victim, or disclose sensitive information. The attack requires user interaction and is limited to users who can view the job logs where the malicious script is stored.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data disclosure, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using XXL-JOB may face compliance risks if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade XXL-JOB to a patched version beyond 3.5.0-SNAPSHOT. Implement strict input validation for executorParam, rejecting or sanitizing any JavaScript or HTML content. Apply output encoding when rendering log pages to prevent script execution. Restrict permissions for manual job triggering to trusted users only.

Useful 0 Not Useful 0