Executive brief
Dependency-Track Frontend is a web interface for managing software vulnerabilities and dependencies. The application failed to sanitize vulnerability descriptions rendered from markdown, allowing authenticated users with vulnerability management permissions to inject malicious JavaScript code. When other users view the affected vulnerability page, the injected code executes in their browser, potentially leading to session hijacking, data theft, or credential compromise.
Technical details
This is a persistent cross-site scripting (XSS) vulnerability in the Dependency-Track Frontend's vulnerability details rendering. The application uses the Showdown JavaScript library to render markdown-formatted vulnerability descriptions, but fails to encode or sanitize the library's HTML output, which lacks built-in XSS protections. An attacker with VULNERABILITY_MANAGEMENT permission can inject arbitrary JavaScript via the Description, Details, Recommendation, or References fields when creating or editing a custom vulnerability. The payload executes in the context of any user with VIEW_PORTFOLIO permission who visits the modified vulnerability page. While vulnerability data from upstream sources (NVD, GitHub Advisories, OSV, etc.) could theoretically carry malicious payloads, the advisory indicates this has not been observed in practice. The vulnerability was patched in version 4.6.1.
Affected products
- Dependency-Track Frontend before 4.6.1
Timeline
- 2022-10-25: disclosed
- 2022-10-25: patched: Fixed in version 4.6.1