QuestDB Web Console Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the QuestDB Web Console component, affecting QuestDB UI versions prior to 1.11.9. The vulnerability allows for the injection of malicious scripts that can be executed in the context of the user's browser. This issue can be exploited remotely, but requires user interaction.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject and execute scripts in the context of the user's session.

Reproduction

To reproduce this vulnerability, create a Docker container running QuestDB with the default ports exposed. Then, access the QuestDB Web Console and execute a SQL query that includes an HTML iframe element with a data URI. This will inject the iframe into the page, bypassing the application's content security policy and potentially leading to the execution of scripts.

Remediation

Users are advised to upgrade to QuestDB UI version 1.1.10 or later, where this vulnerability has been fixed.