Hayabusa Cross-Site Scripting Vulnerability in HTML Report Output

A cross-site scripting (XSS) vulnerability has been identified in Hayabusa versions prior to 3.8.0. This issue resides in the HTML report generation, where an attacker can execute arbitrary JavaScript. The vulnerability is triggered when a user scans JSON-exported logs that contain malicious content in the 'Computer' field. The injected JavaScript executes in the forensic examiner's browser session while viewing the report, potentially leading to information disclosure or unauthorized code execution.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected JavaScript is executed in the context of the user's browser session.

Remediation

Users can update to Hayabusa version 3.8.0 or later, where this vulnerability has been fixed.