Zammad HTML Sanitization Vulnerability in Ticket Articles Allowing Data URI Injection

A vulnerability exists in Zammad, a web-based open-source helpdesk and customer support system, in versions prior to 7.0.1 and 6.5.4. The issue arises from the HTML sanitizer for ticket articles, which failed to properly sanitize 'data: ...' URI schemes. This oversight allowed malicious content to be stored in the database of affected Zammad instances. Although the Zammad GUI renders this content, applied Content Security Policy (CSP) rules prevented any harm from, for example, clicking such a link.

Impact

Exploitation of this vulnerability could lead to the injection of malicious 'data: ...' URIs into the Zammad database, which are then rendered in the Zammad GUI. While this could potentially be exploited to execute harmful actions, the existing CSP rules currently mitigate such risks.

Remediation

Users can upgrade to Zammad versions 7.0.1 or 6.5.4 to address this vulnerability.