Executive brief
redis-commander is a web-based management tool for Redis databases. A reflected cross-site scripting (XSS) vulnerability in the clipboard.swf component allows an attacker to inject malicious scripts via a crafted URL. If a user visits a malicious link while using redis-commander, the attacker can steal session data, credentials, or perform actions on their behalf, though exploitation requires Flash to be enabled.
Technical details
A reflected cross-site scripting vulnerability exists in the highlighterId parameter of the clipboard.swf component bundled with redis-commander versions prior to 0.5.0. The vulnerability results from insufficient input sanitization, allowing an attacker to inject arbitrary JavaScript via a specially crafted URL query parameter. The attack is reflected (not stored) and requires that the victim click a malicious link and have Flash installed and enabled in their browser. An attacker can execute arbitrary JavaScript in the victim's browser context, potentially leading to session hijacking, credential theft, or unauthorized actions on the Redis instance. The vulnerability was fixed in version 0.5.0 by updating the jstree library to version 3.3.5.
Affected products
- redis-commander redis-commander prior to 0.5.0
Timeline
- 2020-09-01: disclosed
- 2020-09-01: patched: Fixed in version 0.5.0