Description

Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.8",
  "pubDate": "2026-08-13T21:17:45.683Z",
  "pubdate": "2026-08-13T21:17:45.683Z",
  "executiveSummary": "Worksuite SaaS versions prior to 6.0.14 contain a stored cross-site scripting (XSS) vulnerability within the Asset Management module. This security flaw enables authenticated administrators to inject arbitrary JavaScript payloads via the Location and Description fields during the creation of a new asset.\nThe primary impact of this vulnerability is the persistent storage of malicious HTML and script tags within the application database. These payloads automatically execute within the context of any user's browser who subsequently views the affected asset details.\nAffected systems include Worksuite SaaS instances running versions prior to 6.0.14. The risk implications encompass potential session hijacking, credential theft, and the execution of unauthorized actions on behalf of authenticated victims.\nTo successfully execute this attack, an adversary requires administrative authentication and the specific privilege to create or modify assets within the Asset Management module, allowing them to inject the malicious strings directly into the vulnerable input fields.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization, neutralization, and context-aware output encoding of user-supplied input within the Asset Management module of Worksuite SaaS.\nSpecifically, the Location and Description fields fail to adequately filter or escape special characters such as angle brackets (< and >) and JavaScript execution contexts before committing the data to the application database.\nThe vulnerable components are the server-side input validation and client-side output rendering mechanisms handling asset creation and display functionalities across versions prior to 6.0.14.\nAuthentication and privilege requirements dictate that the threat actor must possess valid administrative credentials and the authorization to access the Asset Management module to input the malicious payloads.\nThe attack flow proceeds as follows: First, the authenticated administrator navigates to the asset creation interface. Second, the attacker inputs crafted HTML and JavaScript payloads into the Location and Description input fields. Third, the application accepts the input without sufficient sanitization and stores the malicious strings persistently within the backend database.\nSubsequent exploitation occurs when any user, including other administrators or privileged personnel, views the affected asset details. The application retrieves the stored malicious payload from the database and renders it directly into the Document Object Model (DOM) without proper output encoding.\nThe payload behavior involves the immediate execution of the arbitrary JavaScript within the victim browser's session, leveraging the user's active session cookies and permissions.\nThe post-exploitation impact includes session hijacking via DOM access to sensitive storage mechanisms, credential harvesting, unauthorized administrative actions performed on behalf of the victim, and potential lateral movement or privilege escalation within the SaaS environment depending on the victim's permission level."
}