LORIS Reflected Cross-Site Scripting Vulnerability in Help Editor Module

A reflected cross-site scripting vulnerability has been identified in the help_editor module of LORIS (Longitudinal Online Research and Imaging System) versions 15.10 prior to 27.0.3 and 28.0.1. The vulnerability arises because the module did not adequately sanitize user-supplied variables, potentially allowing an attacker to execute a cross-site scripting attack by tricking a user into clicking a malicious link. Additionally, the same input vector could be exploited to download arbitrary markdown files from an unpatched server.

Impact

Exploitation of this vulnerability could lead to reflected cross-site scripting, allowing an attacker to inject malicious scripts that are executed in the context of the user's browser. On unpatched servers, the vulnerability could also be exploited to download arbitrary markdown files.

Remediation

Users can update to LORIS versions 27.0.3 or 28.0.1 to address this vulnerability. Alternatively, the help_editor module can be disabled, although this may disrupt the inline help feature in LORIS.