Description

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-18T11:16:51.920Z",
  "pubdate": "2026-08-18T11:16:51.920Z",
  "executiveSummary": "SpiderFoot is affected by a stored Cross-Site Scripting (XSS) vulnerability arising from the application's failure to properly HTML-escape correlation titles constructed from external scan data sources, such as server banners and metadata. This security flaw enables remote attackers to inject malicious HTML elements and event handlers into correlation results. When an operator accesses the correlations view within the user interface, the injected scripts execute within the context of the operator's browser session. The primary risk implication of this vulnerability is the potential compromise of operator sessions and the unauthorized extraction of sensitive information, such as API keys stored within the application. Exploitation requires the attacker to supply or influence external scan data that is subsequently processed by the correlation engine and reviewed by an authenticated user in the administrative or operator interface.",
  "technicalDetails": "The root cause of the vulnerability is insufficient input sanitization and output encoding within the SpiderFoot correlation engine and web interface rendering components. Specifically, correlation titles are dynamically constructed using untrusted external scan data sources—including server banners, service metadata, and target footprinting details—without performing adequate HTML entity encoding. Because the application blindly trusts and renders these unescaped strings in the correlations view, malicious payloads injected into target environments are reflected directly into the Document Object Model (DOM) of the operator's browser.\nThe attack flow proceeds in a sequential manner. First, an attacker interacts with an externally exposed service or supplies target metadata designed to be harvested during a SpiderFoot reconnaissance scan. This poisoned data contains crafted HTML markup incorporating malicious JavaScript event handlers, such as 'onerror' or 'onload' attributes within custom HTML elements. Second, SpiderFoot ingests this external scan data during the execution of scanning modules. Third, the application's internal correlation rules evaluate the harvested data and dynamically build correlation titles containing the malicious payload.\nFourth, an operator or administrator accesses the correlations view in the SpiderFoot web interface to analyze the scan results. As the browser parses the rendered HTML of the correlations view, the unescaped correlation title executes the embedded JavaScript payload within the security context of the operator's active session. Because the script executes with the permissions of the authenticated user, it possesses the capability to interact with the Document Object Model, access session cookies, and query local storage or internal API endpoints. Consequently, the payload can exfiltrate sensitive data, including stored API keys and session identifiers, to an attacker-controlled remote server, leading to potential privilege escalation or lateral movement within connected environments."
}