Description

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-04T12:17:24.863Z",
  "pubdate": "2026-09-04T12:17:24.863Z",
  "executiveSummary": "OpenPanel versions prior to 2.3.0 are susceptible to a critical Cross-Site Scripting (XSS) vulnerability located within the unauthenticated /misc/favicon endpoint.\nThis vulnerability originates from an improper validation mechanism in the favicon proxy functionality, which allows for the rendering of attacker-supplied SVG files.\nBy hosting a malicious SVG file containing embedded JavaScript, a remote, unauthenticated attacker can force the victim's browser to execute arbitrary code within the context of the application's origin.\nThe primary impact of this flaw is the potential for session hijacking, unauthorized API interactions, and the exfiltration of sensitive information.\nBecause the payload executes on the API origin, it effectively bypasses standard Same-Origin Policy (SOP) protections, granting the malicious script full access to authenticated session tokens and cookies.\nThe attack is highly effective as it requires no prior authentication or user interaction with the attacker's specific infrastructure beyond the victim clicking a crafted link or visiting a compromised page.\nThe risk profile is classified as high due to the potential for total account compromise and the accessibility of the vulnerable endpoint to any remote, unauthenticated party.",
  "technicalDetails": "The vulnerability resides in the favicon proxy handler located at GET /misc/favicon. The component is designed to retrieve and serve icons from external URLs to the client browser.\nThe root cause of this security defect is the failure to sanitize or validate the content type and structure of the remotely retrieved icon file. Specifically, the application does not enforce restrictions on Scalable Vector Graphics (SVG) files, which are treated as valid image resources by browsers.\nBecause SVG files are XML-based, they permit the inclusion of <script> tags or event handlers (such as onload). When the browser processes the SVG returned by the /misc/favicon endpoint, it executes any embedded JavaScript within the security context of the OpenPanel domain.\nThe attack flow proceeds as follows: First, the attacker hosts a malicious SVG file on an attacker-controlled server. This file contains a benign image payload along with an embedded JavaScript snippet designed to perform unauthorized actions, such as sending a background XHR/fetch request to authenticated OpenPanel API endpoints.\nSecond, the attacker constructs a URL targeting the /misc/favicon endpoint, supplying the URL of the malicious SVG file as a parameter.\nThird, the attacker induces a victim with an active session to navigate to this crafted URL. The OpenPanel server acts as a proxy, fetching the malicious SVG from the attacker's server and serving it back to the victim's browser.\nFinally, upon the browser rendering the favicon, the embedded script executes. Because the script is running on the origin of the OpenPanel domain, it inherits the session cookies and credentials associated with that domain. The script can then perform authenticated actions on behalf of the victim without their consent, potentially leading to unauthorized data modification, administrative actions, or credential theft.\nThis vulnerability is particularly dangerous as the /misc/favicon endpoint is unauthenticated, allowing any remote user on the network to initiate the proxy process. The lack of Content Security Policy (CSP) headers specifically tailored to block inline scripts in SVGs exacerbates the risk of successful exploitation in older versions of the product."
}