Casdoor Cross-Site Scripting Vulnerability in Version 2.356.0

A cross-site scripting (XSS) vulnerability has been identified in Casdoor version 2.356.0. This issue arises in the 'dangerouslySetInnerHTML' function, where the 'formCss', 'formCssMobile', and 'formSideHtml' fields can be manipulated to inject malicious scripts. The vulnerability can be exploited remotely, and an exploit is publicly available.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an organization admin must inject malicious JavaScript into the 'formCss', 'formCssMobile', or 'formSideHtml' fields of the application settings. Once the malicious content is saved, it will be executed for every user who visits the login page. For example, injecting an image tag with an 'onerror' event that fetches cookies and sends them to an external server will result in session cookie theft.

Remediation

No known mitigation is available.