Executive brief
lightning-server is a web framework used to build interactive data visualization applications. The vulnerability allows authenticated users to inject malicious JavaScript code through session controller parameters, which can then execute in other users' browsers when they access affected pages. This could lead to unauthorized access to sensitive data, session hijacking, or defacement of the application interface.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) in the session controller of lightning-server affecting all versions up to 1.3.0. An authenticated user can inject malicious JavaScript code as part of session controller parameters, which is not properly sanitized before being reflected in responses. The vulnerability requires authentication and user interaction (a victim must visit a crafted link), but allows an attacker to execute arbitrary JavaScript in the victim's browser context. No patch information is provided in the advisory.
Affected products
- lightning-viz lightning-server ≤1.3.0
Timeline
- 2020-10-20: disclosed
- 2021-05-10: advisory