Executive brief
FastAPI Admin is a web-based administration panel for FastAPI applications. A stored cross-site scripting (XSS) vulnerability in the product creation feature allows attackers to inject malicious scripts that are permanently stored and executed when other users view the product. An attacker could steal user session cookies, perform unauthorized actions, or redirect users to malicious sites.
Technical details
A stored XSS vulnerability exists in the Create Product function of FastAPI Admin due to insufficient input validation and output encoding of the Product Name parameter. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). An unauthenticated attacker with access to the admin interface can inject arbitrary HTML/JavaScript payloads (e.g., `<img src=1 onerror=alert(document.cookie)>`) into the product name field; these payloads are stored in the database and executed in the browsers of all users who subsequently view the product list. The attack requires user interaction (viewing the affected page) and can impact confidentiality and integrity. The vulnerability affects fastapi-admin versions 0.1.1 through 0.1.4.
Affected products
- FastAPI Admin fastapi-admin 0.1.1 through 0.1.4
Timeline
- 2024-08-25: disclosed: Vulnerability reported via GitHub issue
- 2024-08-26: advisory: GHSA-22xm-w7r2-834q published