Description

Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-24T22:16:51.773Z",
  "pubdate": "2026-08-24T22:16:51.773Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in Boost versions <= 2.0.4. This security flaw enables remote attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered by the vulnerable application. The primary impact of this vulnerability includes session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users interacting with the compromised interface. The affected product is Boost versions 2.0.4 and prior. The risk implications are critical as successful exploitation bypasses authentication boundaries entirely, allowing unauthenticated threat actors to interact directly with the Document Object Model (DOM) of the victim's browser session. Attacker capabilities include the execution of arbitrary script code within the context of the user's browser, potentially leading to full compromise of the user session. Exploitation requirements are minimal, as the vulnerability is unauthenticated and typically requires only that a victim navigates to a maliciously crafted URL or interacts with poisoned input vectors processed by the application.",
  "technicalDetails": "The vulnerability resides in the input handling and output rendering mechanisms of Boost <= 2.0.4, where user-supplied data is processed and reflected back to the client without adequate sanitization, context-aware encoding, or output escaping. The root cause is the failure of the application to neutralize special characters such as angle brackets (< and >), quotes, and script tags within HTTP request parameters before rendering them in the Hypertext Markup Language (HTML) response. Because the application lacks authentication requirements for the vulnerable endpoints, any remote network-exposed attacker can initiate the exploitation sequence without possessing valid credentials or elevated privileges.\nThe attack flow proceeds as follows. First, the attacker crafts a malicious payload containing executable JavaScript encapsulated within HTML tags or event handlers, such as image onerror attributes. Second, the attacker induces a victim to execute an HTTP request containing this payload, frequently via phishing links, reflected parameters, or stored data vectors depending on the specific application architecture. Third, the Boost application ingests the unvalidated input and includes it directly within the generated HTTP response body sent back to the victim browser. Fourth, the victim's browser parses the HTTP response, fails to distinguish between legitimate application code and injected attacker data, and executes the script within the security context of the origin domain. The payload behavior encompasses executing arbitrary JavaScript routines, which can access document.cookie, perform unauthorized asynchronous XMLHttpRequest or Fetch API calls to internal resources, manipulate the DOM, or redirect the user to a malicious phishing infrastructure. The post-exploitation impact includes complete loss of user session integrity, unauthorized modification of application data, and potential lateral movement or privilege escalation if administrative interfaces are targeted via session hijacking."
}