awslabs/aws-js-s3-explorer

xss injection

53n4d opened this issue · 2 comments

53n4d commented

Hi, how are you?

I want to report xss vulnerability in aws s3 explorer. POC is below:

Click on the settings icon in the top right corner. Popup will open to enter S3 bucket name.
Type a payload as you can see on this image, and press enter:

Screenshot from 2024-03-05 14-31-14

And you'll get an xss:
Screenshot from 2024-03-05 14-31-23

john-aws commented

Thanks for the report and a quick way to repro the problem.

  • 👍1
53n4d commented

Just to inform, i reported this to: https://cveform.mitre.org/ as a cve request, to inform users about affected version, because xss is usually high or critical vulnerability.

Thank you for your prompt response and quick fix.

  • 👍1
  • 🚀1