ClipBucket Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in ClipBucket version 5.5.3 #58 and prior. This issue allows a normal authenticated user to inject an XSS payload, which is then executed when an administrator interacts with the affected collection. The vulnerability arises from insufficient input sanitization in the collection management feature.

Impact

Exploitation of this vulnerability allows for arbitrary JavaScript execution in the context of the administrator.

Reproduction

To reproduce this vulnerability, log in as a normal user and navigate to the 'Manage Collections' page. Create a new collection and enter an XSS payload in the 'Collection Name' field. After saving the collection, add a video to it to make it visible to others. Finally, log in as an administrator, go to the notifications page, and click on 'Flagged Collections' to trigger the XSS payload.

Remediation

Users can update to ClipBucket version 5.5.3 #59 or later, where this vulnerability has been fixed.