PYSEC-2024-249

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/label-studio/PYSEC-2024-249.yaml
JSON Data
https://api.test.osv.dev/v1/vulns/PYSEC-2024-249
Aliases
Related
Published
2024-02-22T22:15:47Z
Modified
2025-05-19T11:57:55.051011Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Summary

On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a Choices or Labels tag, resulting in an XSS vulnerability.

Details

Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1.

PoC

  1. Create a project. Create a project

  2. Upload a file containing the payload using the "Upload Files" function. 2  Upload a file containing the payload using the Upload Files function 3  complete

The following are the contents of the files used in the PoC

{
  "data": {
    "prompt": "labelstudio universe image",
    "images": [
      {
        "value": "id123#0",
        "style": "margin: 5px",
        "html": "<img width='400' src='https://labelstud.io/_astro/images-tab.64279c16_ZaBSvC.avif' onload=alert(document.cookie)>"
      }
    ]
  }
}
  1. Select the text-to-image generation labeling template of Ranking and scoring 3  Select the text-to-image generation labelling template for Ranking and scoring 5  save

  2. Select a task 4  Select a task

  3. Check that the script is running 5  Check that the script is running

Impact

Malicious scripts can be injected into the code, and when linked with vulnerabilities such as CSRF, it can cause even greater damage. In particular, It can become a source of further attacks, especially when linked to social engineering.

References

Affected packages

PyPI / label-studio

Package

Affected ranges

Type
GIT
Repo
https://github.com/humansignal/label-studio
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.11.0

Affected versions

0.*

0.4.1
0.4.2
0.4.3
0.4.4
0.4.4.post1
0.4.4.post2
0.4.5
0.4.6
0.4.6.post1
0.4.6.post2
0.4.7
0.4.8
0.5.0
0.5.1
0.6.0
0.6.1
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.4.post0
0.7.4.post1
0.7.5.post1
0.7.5.post2
0.8.0
0.8.0.post0
0.8.1
0.8.1.post0
0.8.2
0.8.2.post0
0.9.0
0.9.0.post2
0.9.0.post3
0.9.0.post4
0.9.0.post5
0.9.1
0.9.1.post0
0.9.1.post1
0.9.1.post2

1.*

1.0.0
1.0.0.post0
1.0.0.post1
1.0.0.post2
1.0.0.post3
1.0.1
1.0.2
1.0.2.post0
1.1.0rc0
1.1.0
1.1.1
1.2
1.3
1.3.post0
1.3.post1
1.4
1.4.1
1.4.1.post0
1.4.1.post1
1.5.0
1.5.0.post0
1.6.0
1.7.0
1.7.1
1.7.2
1.7.3
1.8.0
1.8.1
1.8.2
1.8.2.post0
1.8.2.post1
1.9.0
1.9.1
1.9.1.post0
1.9.2
1.9.2.post0
1.10.0
1.10.0.post0
1.10.1