Stored XSS in Crafty Controller via Audit Logs HTTP Header Injection

Executive Summary

This is a critical stored cross-site scripting (XSS) vulnerability in Crafty Controller v4.10.7. It allows unauthenticated attackers to inject malicious JavaScript into audit logs via crafted HTTP headers like X-Real-IP or X-Forwarded-For. When a privileged user views the Activity Logs page, the injected script executes with superuser privileges, enabling further attacks.

Useful 0 Not Useful 0

Detection Guidance

Monitor Crafty Controller's audit logs for suspicious entries containing HTML or JavaScript code in the IP address fields. Check for unexpected API key creation, server modifications, or command changes in logs. Inspect HTTP headers for crafted X-Real-IP or X-Forwarded-For values.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control over the Crafty Controller system. This includes creating API keys with full access, modifying server commands, starting servers, and executing arbitrary commands as the operating system user running Crafty Controller. The attacker needs to know a valid username and craft a forwarding header.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. It may result in unauthorized data exposure, modification, or deletion, leading to compliance violations and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Crafty Controller to a patched version. Disable or sanitize X-Real-IP and X-Forwarded-For headers in login routes. Treat all audit log fields as plain text and avoid HTML interpolation. Implement HttpOnly, Secure, and SameSite cookie attributes. Add a Content Security Policy to block inline scripts.

Useful 0 Not Useful 0