GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic.
An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
jeromedevome:grr
References 3
https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2
https://github.com/JeromeDevome/GRR/security/advisories/GHSA-r6x2-w38j-vvq2
https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd6…
https://github.com/JeromeDevome/GRR/commit/4ef77f91818215c1f8e0f06023d89257dfd61c68
https://github.com/JeromeDevome/GRR/tree/v4.5.0
https://github.com/JeromeDevome/GRR/tree/v4.5.0