Cross-site Scripting Affecting label-studio package, versions [,1.10.1)

label-studio is a Label Studio annotation tool

Affected versions of this package are vulnerable to Cross-site Scripting via the remote import feature which allowed users to import data from a remote web source. An attacker can execute malicious JavaScript code in the context of the website by crafting a payload that, when visited, performs unauthorized actions such as adding a new super administrator user.

Note:

If an attacker can craft a JavaScript payload that adds a new Django Super Administrator user if a Django administrator visits the image. This may highly impact the subsequent system.

1. For all user provided files that are downloaded by Label Studio, set the Content-Security-Policy: sandbox; response header when viewed on the site. The sandbox directive restricts a page's actions to prevent popups, execution of plugins and scripts and enforces a same-origin policy documentation.

2. Restrict the allowed file extensions that could be downloaded.

• GitHub Commit
• Vulnerable Code
• Vulnerable Code