Canarytokens Self Cross-Site Scripting Vulnerability in PWA Token

A self cross-site scripting vulnerability has been identified in the "PWA" Canarytoken, affecting versions prior to sha-7ff0e12. This issue allows the creator of a PWA Canarytoken to inject JavaScript into the title field. When the creator accesses the installation page for their token, the injected JavaScript executes. This self-XSS vulnerability could be exploited by sending the installation link to a victim, who would unknowingly execute the JavaScript. However, no sensitive information, such as session data, would be disclosed to the attacker.

Impact

Exploitation of this vulnerability allows for self cross-site scripting, where injected JavaScript is executed in the context of the user who created the Canarytoken.

Remediation

Users of self-hosted Canarytokens installations can update by pulling the latest Docker image or any Docker image after sha-7ff0e12.