Kanboard Stored Cross-Site Scripting Vulnerability in Project Creation

A stored cross-site scripting vulnerability has been identified in Kanboard versions 1.2.26 through 1.2.44. The issue resides in the 'name' parameter of the Project Creation form. This vulnerability allows attackers to inject malicious scripts that are executed when other users view the affected project. While the default content security policy blocks JavaScript-based attacks, this vulnerability could be exploited in instances with a misconfigured CSP that allows CSS injection, as seen with the default 'unsafe-inline' directive.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the project.

Reproduction

To reproduce this vulnerability, create a project and then inject a script payload into the 'name' parameter of a second project. After saving, view the first project and click the 'Import Tasks' button, which triggers the execution of the injected script.

Remediation

Users can update to Kanboard version 1.2.45, which addresses this vulnerability.