Agora Foundation Agora XSS Vulnerability in editorManager.js

A cross-site scripting (XSS) vulnerability has been identified in Agora Foundation's Agora fall23-Alpha1 version, prior to b087490. The issue arises in the editorManager.js file, where user-controlled input is improperly sanitized before being rendered. This vulnerability allows for the injection of malicious scripts that could be executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

The vulnerability can be reproduced by uploading a profile picture that does not meet the file type requirements, which will trigger an error. Additionally, XSS payloads can be submitted to the topic name, which will be rendered without proper sanitization, allowing the injected script to execute.

Remediation

Users can update to Agora Foundation Agora version fall23-Alpha1 b087490 or later, where this vulnerability has been fixed.