Executive brief
django-helpdesk is a Django application for managing IT support tickets and helpdesk operations. A Cross-site Scripting (XSS) vulnerability in the application allows attackers to inject malicious scripts that execute in users' browsers, potentially compromising session cookies, redirecting users to phishing sites, or defacing helpdesk pages viewed by staff and customers.
Technical details
django-helpdesk contains an improper input neutralization vulnerability (CWE-79) allowing Cross-site Scripting attacks. The vulnerability stems from insufficient escaping in markdown pattern handling, as evidenced by a pattern regex fix in the codebase that removed problematic escaping sequences. The attack requires user interaction (UI:R) and is network-accessible with no authentication required. An attacker can inject malicious JavaScript through markdown processing that executes in the context of other users' browsers. The vulnerability has been patched in version 0.3.2 and later.
Affected products
- django-helpdesk django-helpdesk before 0.3.2
Timeline
- 2021-12-01: disclosed: NVD published
- 2021-12-03: advisory: GHSA-2v5j-q74q-r53f published
- 2021-12-03: patched: Fixed in version 0.3.2