SICK Incoming Goods Suite Grafana XSS Vulnerability via Open Redirect

A cross-site scripting (XSS) vulnerability has been identified in the SICK Incoming Goods Suite, specifically within the Grafana component used for log management. This vulnerability arises from a combination of client path traversal and open redirect, allowing attackers to redirect users to a site hosting a frontend plugin that executes arbitrary JavaScript. The issue does not require editor permissions and can be exploited if anonymous access is enabled. Additionally, if the Grafana Image Renderer plugin is installed, the open redirect could be used to achieve full read server-side request forgery (SSRF). The default Content-Security-Policy in Grafana blocks the XSS, except for the 'connect-src' directive.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected JavaScript is executed in the context of the user's browser.

Remediation

Users are strongly recommended to upgrade to the latest release of SICK Incoming Goods Suite (version 1.2.1 or higher).