QuantumNous New-API Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in QuantumNous New-API version 0.8.5.2 and earlier. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser. The issue can affect any user within the system, including those with administrative privileges.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, navigate to the 'Console' feature and then to 'Playground'. Interact with the AI using default settings. Send a message containing XSS payload, which will trigger an error response. After enabling 'Show Debug', the XSS code execution can be observed. To escalate the impact, export the conversation containing the XSS payload and import it while logged in as an admin, which will result in compromising the admin account.