GHSA-xr7p-8q82-878q
teler dashboard vulnerable to DOM-based cross-site scripting (XSS)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | teler.app | >= 2.0.0-rc, < 2.0.0-rc.4 | 2.0.0-rc.4 |
| Go | teler.app | >= 2.0.0-dev, < 2.0.0-dev.2 | 2.0.0-dev.2 |
| Go | teler.app | >= 0.0.0-20220625162531-2289e90590a9, < 0.0.0-20221203202318-20f59eda2420 | 0.0.0-20221203202318-20f59eda2420 |
| Go | teler.app | >= 1.2.3-0.20220625162531-2289e90590a9, < 1.2.3-0.20221203202318-20f59eda2420 | 1.2.3-0.20221203202318-20f59eda2420 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Description
teler prior to version <= 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) in the teler dashboard. When teler requests messages from the event stream on the `/events` endpoint, the log data displayed on the dashboard are not sanitized.
### Impact
This only affects authenticated users and can only be exploited based on detected threats if the log contains a DOM scripting payload. This indicates a low severity and there is no significant impact on the users.
### Affected Version
This issue was introduced from version `v2.0.0-rc` to `v2.0.0-rc.3` & `v2.0.0-dev`.
### Patches
This vulnerability has been fixed on version `v2.0.0-rc.4` & `v2.0.0-dev.2`.
### Workarounds
Here are some workarounds to handle this case:
- Deactivate the live event dashboard from the configuration file, or
- Upgrade teler version to `v2.0.0-rc.4` or `v2.0.0-dev.2` & above.
### References
- https://github.com/kitabisa/teler/commit/20f59eda2420ac64e29f199a61230a0abc875e8e
References
External links from the advisory. They lead to third-party sites.