Description

Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-13T14:16:58.583Z",
  "pubdate": "2026-08-13T14:16:58.583Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in Do Lasso versions 358 and prior. This security flaw enables remote attackers to inject malicious client-side scripts, typically written in JavaScript, into web pages rendered by unsuspecting users. The vulnerability arises from improper neutralization of user-supplied input before it is reflected back to the client, lacking adequate output encoding or context-aware sanitization mechanisms.\nThe primary impact of this vulnerability includes session hijacking, credential theft, unauthorized actions performed on behalf of authenticated users, and the potential manipulation of the Document Object Model (DOM) within the affected application context. Because the vulnerability is unauthenticated, threat actors do not require prior access credentials or elevated privileges to initiate an attack vector, lowering the barrier to exploitation significantly. Successful exploitation relies on the victim interacting with a maliciously crafted URL or input vector that triggers the execution of arbitrary script code within their active browser session. The risk implication is moderate to high depending on the sensitivity of the data handled by the application and the privileges of the interacting user, potentially compromising the integrity and confidentiality of user sessions interacting with the Do Lasso platform.",
  "technicalDetails": "The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw residing within Do Lasso versions <= 358. The root cause stems from the application accepting user-supplied input via HTTP requests—such as query parameters or form submissions—and subsequently reflecting this data within the Hypertext Markup Language (HTML) response without implementing robust input validation, output encoding, or sanitization routines.\nThe vulnerable component involves the application's request handling and response generation logic, which fails to neutralize executable content contained within HTTP inputs. Because the flaw is classified as unauthenticated, network exposure is public-facing, allowing any remote attacker with network access to the web application to craft and deliver malicious payloads without needing pre-existing authentication credentials or privilege levels.\nThe attack flow proceeds in a sequential manner. First, the attacker crafts a malicious Uniform Resource Locator (URL) or an HTTP request containing an arbitrary script payload (e.g., <script>alert(document.cookie)</script>) targeted at a vulnerable endpoint in Do Lasso. Second, the attacker induces a victim—such as an authenticated user or administrator—to click the crafted link or visit the malicious URL via social engineering or other delivery mechanisms. Third, the Do Lasso web application processes the incoming request containing the malicious input and reflects the unescaped payload directly into the HTTP response body. Fourth, the victim's web browser receives the response, parses the HTML, and executes the injected JavaScript within the context of the user's session.\nThe payload behavior involves executing arbitrary client-side code within the security context of the victim's browser. This grants the attacker the ability to access Document Object Model (DOM) elements, read sensitive session identifiers such as cookies or local storage tokens, capture keystrokes, or issue unauthorized asynchronous HTTP requests (AJAX/Fetch) acting as the victim. The post-exploitation impact includes full session compromise, account takeover, defacement of the web interface, or pivoting to perform further actions authorized exclusively by the targeted user."
}