Red Hat Advanced Cluster Security Cross-Site Scripting Vulnerability in Portal

A cross-site scripting (XSS) vulnerability has been identified in the Red Hat Advanced Cluster Security (RHACS) portal. This issue arises when the portal renders a table view, particularly on endpoints under '/main/configmanagement/*'. The front-end creates a DOM table element with the id 'pdf-table', which is filled with unsanitized data using innerHTML. An attacker with some control over the rendered data can exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user must create a RHACS policy or an OpenShift cluster role with a specially crafted name that includes unsanitized data. Once this data is rendered in the RHACS portal, the XSS vulnerability can be observed.