Executive brief
Libops Captcha Protect is a security tool for the Traefik proxy that presents anti-bot challenges to users when suspicious traffic is detected. A security flaw in this tool allows attackers to perform cross-site scripting (XSS) attacks by tricking a user into clicking a malicious link. If successful, an attacker could execute unauthorized scripts in the user's browser, potentially leading to the theft of session information or unauthorized actions on the affected website.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the libops/captcha-protect Traefik middleware. The vulnerability is rooted in the challenge page's use of Go's 'text/template' engine to render a client-supplied 'destination' parameter. Because 'text/template' does not perform contextual HTML escaping, an attacker can provide a crafted payload that breaks out of the hidden input attribute to inject arbitrary JavaScript. This requires a victim to interact with a malicious URL. The issue is mitigated if 'challengeURL' is set to an empty string (inline challenges). The vulnerability was fixed in version 1.12.2 by migrating to 'html/template' and implementing stricter destination path normalization.
Affected products
- libops captcha-protect < 1.12.2
Timeline
- 2026-03-26: patched: Version 1.12.2 released
- 2026-03-31: disclosed: Public advisory published