A vulnerability was found in Stroom version 5.5 and 6.0, this has now been patched. Please use versions greater than or equal to 5.5.12 or 6.0.25 going forward.

Impact

An attacker website is able to load the Stroom UI into a hidden iframe. Using that iframe, the attacker site can issue commands to the Stroom UI via an XSS vulnerability to take full control of the Stroom UI on behalf of the logged-in user.

Proof of Concept

A full proof of concept write up has been published here.

Additional Information

• A full write up and Proof of Concept can be found in this Gist here.
• CVSSv3.1 score 8.1/10: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N&version=3.1
• Fix issues #1333 & #1335 (Fix commits linked from the issues)

We'd like to thank the reporter: Jonathan Leitschuh