RELATE Stored Cross-Site Scripting Vulnerability Allowing Admin Account Takeover

A stored cross-site scripting vulnerability has been identified in RELATE, a web-based courseware package, affecting versions through 2024.1. The issue allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to a full admin account takeover. The vulnerability arises in the 'get_user()' method of the 'ParticipationAdmin' class, where user-controlled input is rendered using 'mark_safe' and Python's string formatting. This combination bypasses Django's automatic HTML escaping. The unsanitized data, sourced from editable user profile fields, is executed in the admin's browser when the Participation list is viewed.

Impact

Exploitation of this vulnerability could result in a stored cross-site scripting issue, allowing for the execution of malicious scripts in the context of the administrator's session.

Remediation

Users can update to the latest version of RELATE to address this vulnerability.