aimhubio Aim Text Explorer Component Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Text Explorer component of aimhubio/aim, specifically in version 3.23.0. This vulnerability allows for the execution of arbitrary JavaScript by exploiting the application's tracked text feature. The issue arises because HTML content is rendered using dangerouslySetInnerHTML without proper sanitization, leaving the application open to script injection. Malicious HTML can be injected during the training process, and when the tracked text is viewed in the Text Explorer, the injected JavaScript is executed.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking or other malicious actions.

Reproduction

To reproduce this vulnerability, first upload a tracked text containing malicious HTML, such as an image tag with an onerror attribute, using the aim Python package. This can be done by creating a new run and tracking the text with the injected HTML. After the malicious text is uploaded, visit the Text Explorer component in the aim UI and the injected JavaScript will execute.

Remediation

Sanitize the HTML content before rendering it in the Text Explorer component. This can be done using a library like DomPurify to ensure that only safe HTML is displayed and that JavaScript execution is blocked.