Description

Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-27T10:16:38.393Z",
  "pubdate": "2026-08-27T10:16:38.393Z",
  "executiveSummary": "CozyStay versions 1.10.0 and earlier are susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability allows remote, unauthenticated attackers to inject malicious client-side scripts into web pages viewed by other users.\nThe flaw stems from improper neutralization of user-supplied input before rendering it in the application interface.\nSuccessful exploitation enables an attacker to execute arbitrary JavaScript within the security context of the victim's session.\nImpacts include unauthorized access to session cookies, sensitive user data exfiltration, session hijacking, and the potential for defacement or redirection to malicious third-party websites.\nThe vulnerability is critical as it requires no prior authentication, allowing any visitor to target users, including those with elevated administrative privileges.\nRisk implications are high for environments where user trust and session integrity are paramount for backend management.",
  "technicalDetails": "The vulnerability exists due to a failure in the input validation and output encoding mechanisms within the CozyStay application, specifically affecting versions <= 1.10.0.\nThe application processes user-supplied data and reflects it back to the browser without adequate sanitization or context-aware encoding. This failure permits the injection of arbitrary HTML and JavaScript tags into the DOM (Document Object Model).\nBecause the vulnerability is unauthenticated, the attack vector is accessible over the network without requiring any application-level credentials. An attacker can craft a malicious URL or payload and induce a victim—potentially an administrator—to execute the script by simply visiting a crafted link or interacting with a compromised input field.\nThe attack flow follows a classic reflected or stored XSS pattern: First, the attacker identifies an injection point where user input is reflected in the HTTP response. Second, the attacker crafts a payload containing malicious JavaScript, such as '><script>alert(document.cookie)</script>. Third, the application accepts this payload and includes it directly in the source code of the generated page. Fourth, when a victim's browser parses the malicious content, it interprets the payload as legitimate code and executes it within the origin of the CozyStay application.\nThe post-exploitation impact is significant. By executing code in the victim's browser, an attacker can bypass Same-Origin Policy (SOP) restrictions to read sensitive data stored in local storage, session storage, or cookies. Furthermore, the attacker can leverage the victim's current session to perform unauthorized actions on behalf of the user, such as modifying account configurations, altering booking details, or performing administrative functions if the victim holds high-privilege credentials. The lack of HttpOnly or Secure cookie flags often exacerbates the ability to exfiltrate session identifiers, facilitating account takeovers."
}