Executive brief
LocalStack is a popular open-source AWS cloud emulator used by developers to test cloud applications locally. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts that execute in the browsers of developers using LocalStack, potentially bypassing security protections and enabling further attacks on the local instance.
Technical details
The vulnerability is a reflected or stored cross-site scripting (CWE-79) in LocalStack's web interface. The XSS flaw allows an attacker to inject unescaped JavaScript code that executes in a victim's browser when they interact with LocalStack. Because LocalStack explicitly allows cross-origin requests by setting permissive CORS headers (Access-Control-Allow-Origin: *), this XSS vulnerability can be chained with other attacks to bypass browser same-origin protections. An attacker can craft a malicious website that tricks a developer into visiting it; the XSS payload executes in the context of the developer's LocalStack instance, enabling further exploitation such as CSRF-based configuration manipulation to inject proxy backdoors. No authentication is required since LocalStack is designed for local development environments.
Affected products
- LocalStack LocalStack 0.12.10 and earlier
Timeline
- 2021-05-07: disclosed: Published by NVD
- 2021-06-18: advisory: GitHub Security Advisory published