Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2022-32178
Date: October 29, 2022
Overview
In Label-Studio, v1.0.0 to v1.5.0post0 are vulnerable to Stored Cross-Site Scripting (XSS) in the “Import Data''. An authenticated attacker can upload a carefully crafted SVG file that will trigger XSS when any authenticated victim will preview the uploaded file.Details
The Label-Studio application is vulnerable to Stored XSS vulnerability, where an attacker can upload an SVG file that contains malicious JavaScript in “Data Import” in order to trigger XSS when any authenticated victim will preview the uploaded file.PoC Details
1. Access http://localhost:8080/user/login/ in the browser and login.2. Go to the project, and navigate to the “Import Data” section and upload an SVG file containing malicious javascript.
3. Then, access http://localhost:8080/user/login/ in another browser and login with the owner of the project and navigate to the project.
4. Copy the uploaded file URL and access in URL and XSS will be triggered.\t
PoC Code
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert(document.domain+'
'+document.cookie);
</script>
</svg>
Affected Environments
Label-Studio versions v1.0.0 through v1.5.0post0Prevention
Upgrade to Label-Studio version 1.6.0Language: Python
Good to know:
| Base Score: |
|
|---|---|
| Attack Vector (AV): | Network |
| Attack Complexity (AC): | Low |
| Privileges Required (PR): | Low |
| User Interaction (UI): | Required |
| Scope (S): | Changed |
| Confidentiality (C): | Low |
| Integrity (I): | Low |
| Availability (A): | None |