Description

A flaw was found in migration-planner. Insufficient validation of the `AgentStatusUpdate.CredentialUrl` field allows an authenticated attacker to store a malicious `javascript:` URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting (XSS), enabling script execution in the victim's session and potentially disclosing sensitive information.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-14T14:16:51.753Z",
  "pubdate": "2026-08-14T14:16:51.753Z",
  "executiveSummary": "A stored Cross-Site Scripting (XSS) vulnerability has been identified in migration-planner. The security flaw stems from insufficient input validation of the AgentStatusUpdate.CredentialUrl field. This deficiency allows an authenticated attacker to inject and persist a malicious javascript: URL within the application storage mechanisms. When a victim subsequently accesses and views this stored data within the Hybrid Cloud Console, the malicious payload is rendered in the context of their active browser session. Successful exploitation results in arbitrary script execution within the victim's session, posing significant risk implications including potential session hijacking, unauthorized data access, and the disclosure of sensitive user or application information. Exploitation of this vulnerability requires authentication and relies on user interaction, specifically requiring a victim to view the compromised URL through the Hybrid Cloud Console interface. The affected product is migration-planner, and the threat actor must possess valid authentication credentials to interact with the vulnerable endpoint and submit the malicious status update payload.",
  "technicalDetails": "The vulnerability resides in the input handling and sanitization logic associated with the AgentStatusUpdate.CredentialUrl field within migration-planner. The root cause of the flaw is the lack of rigorous input validation and output encoding, which permits the acceptance and persistence of arbitrary Uniform Resource Identifier (URI) schemes, specifically the execution-capable javascript: protocol. Authentication is required to interact with the API or component responsible for processing agent status updates, meaning the attacker must be an authenticated user within the system to supply the initial malicious payload. Privilege requirements are limited to those necessary for submitting agent status updates. The vulnerable component fails to validate that the CredentialUrl parameter conforms to safe URI schemas such as http:// or https://, allowing the malicious string to be stored in the backend database without modification.\nThe attack flow proceeds in multiple distinct phases. First, the authenticated attacker crafts a malicious AgentStatusUpdate containing a payload within the CredentialUrl field, such as a javascript: URI designed to execute arbitrary JavaScript code when triggered. Second, the attacker transmits this payload to the migration-planner backend service, which processes and stores the data without enforcing strict schema validation or proper neutralization of dangerous URI schemes. Third, the persistent payload remains dormant until a victim accesses the Hybrid Cloud Console to review agent statuses. Fourth, when the Hybrid Cloud Console retrieves and renders the stored CredentialUrl in the user interface—often improperly embedded within an interactive HTML element such as an anchor tag or dynamic source attribute—the browser interprets the javascript: protocol rather than navigating to a standard web resource.\nUpon rendering, the payload behavior manifests as the immediate execution of arbitrary JavaScript scripts within the security context of the victim's browser session. Because the script executes inside the Hybrid Cloud Console, it inherits the victim's session permissions, DOM access, and cookie privileges. The post-exploitation impact includes the potential theft of session tokens, unauthorized execution of administrative or user-level actions on behalf of the victim, and the exfiltration of sensitive information accessible within the Hybrid Cloud Console interface. The network exposure encompasses the interfaces exposed by migration-planner and the Hybrid Cloud Console where agent statuses are managed and viewed."
}