Agora Foundation Agora XSS Vulnerability in Editor Manager

A cross-site scripting (XSS) vulnerability has been identified in Agora Foundation's Agora fall23-Alpha1 version prior to b087490. The issue arises in the editorManager.js file, where user input is improperly sanitized before being rendered, allowing for the injection of malicious scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

The vulnerability can be reproduced by uploading a profile picture that does not meet the file type requirements, which will trigger an error. Additionally, XSS payloads can be submitted to the topic name field, where they will be rendered as HTML instead of plain text, executing the injected scripts.

Remediation

Users can update to Agora Foundation Agora version b087490 or later, where this vulnerability has been fixed.