Cadwyn Reflected Cross-Site Scripting Vulnerability in Documentation Endpoint

A reflected cross-site scripting vulnerability has been identified in Cadwyn versions 5.4.3 and earlier. The issue arises in the '/docs' endpoint, where the 'version' parameter is not properly sanitized. This flaw allows an attacker to inject and execute JavaScript in the context of the user's session on any application utilizing Cadwyn. The vulnerability can be exploited with a single click and has been addressed in version 5.4.4.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute JavaScript in the context of the user's session.

Reproduction

To reproduce this vulnerability, set up a minimal application using Cadwyn and navigate to the '/docs' endpoint. Append a crafted 'version' parameter that includes JavaScript code, such as an alert function, to trigger the cross-site scripting payload.

Remediation

Users can upgrade to Cadwyn version 5.4.4 to address this vulnerability.