Postorius Cross-Site Scripting Vulnerability in Held Messages Pop-Up

A cross-site scripting (XSS) vulnerability has been identified in Postorius versions through 1.3.13. The issue arises because the application does not properly escape HTML in the message subject when displaying it in the Held messages pop-up. This vulnerability has been actively exploited.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, access the Held messages pop-up in the Postorius admin UI. The pop-up will display the message subject without proper HTML escaping, allowing injected HTML to be rendered. This can be tested by sending a message with a subject that includes HTML tags, such as bold tags, and observing how the subject is displayed in the pop-up.

Remediation

Users can update to Postorius version 1.3.14 or later, where this vulnerability has been fixed.