Executive brief
Metro UI is a popular CSS framework used to build web applications. A reflected cross-site scripting (XSS) vulnerability in the textarea component allows attackers to inject malicious scripts that execute in users' browsers, potentially stealing session tokens, credentials, or sensitive data. This vulnerability affects versions 4.4.0 through 4.5.1 and requires user interaction to exploit.
Technical details
Metro UI versions 4.4.0 to 4.5.1 contain a reflected XSS vulnerability (CWE-79) in the textarea component due to improper input sanitization in the JavaScript function. An attacker can craft a malicious URL containing JavaScript payload that, when clicked by a user, executes in the context of the victim's browser session. The vulnerability requires user interaction (clicking a link) and is network-accessible with no authentication required. An attacker can achieve code execution within the user's browser context, potentially leading to session hijacking, credential theft, or malware distribution. Patches are available in versions after 4.5.1.
Affected products
- Metro UI metro4 4.4.0 to 4.5.1
Timeline
- 2022-10-11: disclosed
- 2022-10-12: advisory: GitHub reviewed