OpenSlides Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in OpenSlides versions prior to 4.2.5. The issue arises when users submit descriptions for Moderator Notes or Agenda Topics. An editor interface allows the insertion of various HTML elements. While <script> tags are properly encoded when reflected, links can be manipulated by adding attributes such as 'onmouseover', enabling the execution of JavaScript in the user's session.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's session.

Reproduction

To reproduce this vulnerability, an authenticated user can submit a topic update through the system's action handling request. The 'text' field can be crafted to include a link with an 'onmouseover' attribute that executes JavaScript, such as an alert, when the link is hovered over.

Remediation

Users can update to OpenSlides version 4.2.5, where this vulnerability has been patched.