Drivin Soluções Cross-Site Scripting Vulnerability in API Handler

A cross-site scripting (XSS) vulnerability has been identified in Drivin Soluções versions prior to 20250226. The issue resides in the API Handler component, specifically within the '/api/school/registerSchool' endpoint. The vulnerability is triggered by manipulating the 'message' argument, which is not properly sanitized before being output to users. This flaw allows remote attackers to inject malicious scripts that are executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the user's browser. This could lead to theft of cookies, session hijacking, redirection to malicious sites, or unauthorized actions performed on behalf of the user.

Reproduction

To reproduce this vulnerability, send a POST request to the '/api/school/registerSchool' endpoint with the 'message' field containing unsanitized JavaScript, such as an image tag with an 'onerror' event. When the response is rendered, the script will execute, demonstrating the XSS vulnerability.

Remediation

It is recommended to implement proper output encoding before displaying user-supplied data, sanitize API responses before rendering them in the front-end, and consider using a Content Security Policy (CSP) to restrict script execution.