Executive brief
Shynet is an open-source web analytics tool used to track website traffic without compromising user privacy. A security flaw in the dashboard allows an unauthenticated attacker to inject malicious scripts into the administrator's view by sending specially crafted web traffic data. If an administrator views the analytics dashboard, the attacker could potentially execute commands in the admin's session, leading to unauthorized access or data modification.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Shynet's dashboard due to improper neutralization of input in the 'urldisplay' and 'iconify' template filters (helpers.py). An unauthenticated attacker can submit malicious 'location' or 'referrer' values via the public ingress endpoint. These values are interpolated into HTML attributes (href, title, and src) without sufficient escaping. Specifically, the 'urldisplay' filter uses single quotes for attributes, allowing an attacker to break out using a single quote and inject event handlers like 'onfocus'. The 'iconify' filter fails to escape the netloc component of a URL before inserting it into a double-quoted src attribute. This allows for arbitrary JavaScript execution in the context of an authenticated administrator's session. The issue is fixed in version 0.14.0 by applying Django's escape() function to the affected interpolation points.
Affected products
- milesmcc Shynet < 0.14.0
Timeline
- 2026-03-15: patched: Fix merged in PR #344 and released in v0.14.0
- 2026-04-03: disclosed: CVE published