Plunk Stored Cross-Site Scripting Vulnerability in Campaign Management

A stored cross-site scripting vulnerability has been identified in Plunk, an open-source email platform that utilizes AWS SES. This issue affects versions prior to 0.9.0 and arises within the campaign management feature. The vulnerability allows authenticated project members to inject malicious scripts into the email body of campaigns. These scripts are then executed in the context of any admin or member who views the campaign in the admin dashboard, where the content is rendered using React's dangerouslySetInnerHTML without proper HTML sanitization. This flaw could lead to session hijacking or unauthorized actions on behalf of the affected user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of users viewing the campaign, potentially leading to session hijacking or unauthorized actions.

Remediation

Users can upgrade to Plunk version 0.9.0 or later to address this vulnerability.