Executive brief
YMFE YApi is a visual API management platform that allows teams to manage and document APIs. A stored cross-site scripting (XSS) vulnerability in the project name field allows authenticated users to inject malicious JavaScript that executes when other users (including administrators) view project details or activity logs. An attacker could steal session tokens, modify project data, or perform actions on behalf of other users.
Technical details
The vulnerability is a stored (persistent) cross-site scripting flaw in the project name field of YMFE YApi versions prior to 1.3.23. The application fails to properly sanitize or encode user input when storing and displaying project names, allowing attackers to inject arbitrary HTML and JavaScript payloads. Exploitation requires an authenticated user account to create or modify a project; the malicious payload then executes in the browsers of other users (including managers and administrators) when they view the project or its operation dynamics. An attacker can achieve session hijacking, data theft, or privilege escalation by executing arbitrary actions on behalf of legitimate users. The vulnerability was patched in version 1.3.23.
Affected products
- YMFE YApi <1.3.23
Timeline
- 2018-08-31: disclosed: Issue reported on GitHub
- 2018-11-21: advisory: GHSA advisory published
- 2018-11-21: patched: Fix available in version 1.3.23