Amazon AWS aws-js-s3-explorer Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability exists in Amazon AWS aws-js-s3-explorer version 1.0.0. The issue arises when a crafted S3 bucket name is entered into a prompt, which is not properly sanitized before being displayed. This flaw allows for the injection of malicious scripts that can be executed in the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, open the application and click on the settings icon in the top right corner. A popup will appear prompting for an S3 bucket name. Enter a payload that includes a script, such as an image tag with an event handler, and press enter. The injected script will be executed, demonstrating the XSS vulnerability.

Remediation

Users are advised to update to the latest version of aws-js-s3-explorer, where this vulnerability has been fixed.