WorkflowFirst StaffWiki Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in WorkflowFirst StaffWiki version 7.0.1.19219. The issue resides in the wff_cols_pref.css.aspx endpoint, where user-supplied input in the URL path is returned without proper sanitization. This allows attackers to inject and execute arbitrary JavaScript in the context of the user's browser by sending a crafted HTTP request. While some payloads can be executed directly, others may require encoding certain characters to evade the application's input validation.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the user's session.

Reproduction

To reproduce this vulnerability, send a request to the wff_cols_pref.css.aspx endpoint with a crafted URL that includes JavaScript payloads. Some characters in the payload may need to be encoded to bypass input validation. Once the request is processed, the injected script will execute in the user's browser.

Remediation

Users are advised to upgrade to the version pending.