Description

Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a cloud principal who can modify a scanned resource tag to store HTML or JavaScript that executes when another user opens the report. This issue is fixed in version 5.37.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T15:18:30.793Z",
  "pubdate": "2026-08-12T15:18:30.793Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within Prowler prior to version 5.37.0. The vulnerability is located in the HTML output formatter component, specifically within the file prowler/lib/outputs/html/html.py, where data derived from finding.resource_tags is processed and inserted into generated HTML reports without appropriate context-aware HTML escaping.\nThe risk implication of this vulnerability involves the potential execution of arbitrary JavaScript within the context of a victim user's browser session when they open a malicious security report generated by Prowler. An attacker capable of modifying cloud resource tags can leverage this capability to inject malicious payloads into cloud environments.\nThe affected product is Prowler, specifically versions prior to 5.37.0. Exploitation requires the attacker to possess permissions to modify a scanned cloud resource's tags with malicious HTML or JavaScript payloads, and requires a user to subsequently generate and view the unescaped HTML report.\nThis vulnerability compromises the integrity of reporting workflows and threatens the confidentiality and integrity of session data for users reviewing cloud security postures. Successful exploitation could lead to unauthorized actions performed within the context of the user viewing the report.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input sanitization and a lack of proper output encoding within the Prowler HTML report generation mechanism. Specifically, the vulnerable component is the HTML output formatter residing in prowler/lib/outputs/html/html.py.\nDuring the report generation process, Prowler processes finding.resource_tags, which are assembled and parsed via the internal functions unroll_dict and parse_html_string. These tags originate directly from cloud infrastructure resources scanned by the platform. The platform fails to apply HTML entity encoding to the string values extracted from these resource tags before embedding them into the structure of the generated HTML output.\nThe attack flow begins when an unprivileged or low-privileged cloud principal with write access to cloud resources injects a specially crafted payload containing HTML or JavaScript (such as <script>alert(1)</script> or event handler attributes) into a resource tag. When Prowler executes a scan against the cloud environment, it retrieves the malicious resource tags during data collection.\nSubsequently, when an administrative user or security analyst initiates a report generation command specifying HTML output format, Prowler aggregates the findings and serializes the unescaped finding.resource_tags directly into the Document Object Model (DOM) of the report file via the vulnerable formatter. No authentication is required to plant the payload within the cloud resource tags, provided the attacker has tag modification privileges on the targeted cloud resource.\nNetwork exposure of the vulnerability is indirect; the payload is stored persistently within the cloud resource tags and transferred into the static or dynamic HTML report artifact. When a victim opens the resulting report file in a web browser, the browser parses the unescaped payload as executable script code rather than harmless text data.\nThe payload behavior executes within the security context of the user viewing the report. Depending on the environment, post-exploitation impact could include session hijacking, unauthorized API calls if the report interface interacts with backend services, or further client-side attacks against the analyst reviewing the security findings."
}