Cockpit Cross-Site Scripting Vulnerability in User Management Feature

A cross-site scripting (XSS) vulnerability has been identified in Cockpit versions through 2.11.3. The issue arises in the user management feature, specifically within the '/system/users/save' endpoint. When the 'name' or 'email' fields are manipulated, it allows for the injection of malicious scripts. This vulnerability can be exploited remotely, and requires user interaction.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, upload a payload containing JavaScript into the 'name' or 'email' fields via the '/system/users/save' endpoint. Although basic script tags are blocked, quotes can be used to inject JavaScript through HTML event handlers, such as 'onmouseover'. Once the payload is saved, it will execute when the injected event is triggered.

Remediation

Users are advised to upgrade to Cockpit version 2.11.4, which addresses this vulnerability.