Description

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-15T11:17:12.737Z",
  "pubdate": "2026-09-15T11:17:12.737Z",
  "executiveSummary": "The Steedos Platform (through version 3.0.15-beta.47) is susceptible to a reflected cross-site scripting (XSS) vulnerability located within the anonymous /api/page/render endpoint.\nThis security flaw stems from improper input sanitization of query parameters, specifically within inline script elements processed during page rendering.\nThe vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript code within the context of a victim's browser session.\nSuccessful exploitation poses a significant security risk, as it enables attackers to perform unauthorized actions on behalf of the user, manipulate the DOM, or exfiltrate sensitive data, including session-specific X-Auth-Token credentials.\nThe vulnerability requires user interaction, typically through a maliciously crafted URL provided to an authenticated user.\nGiven the potential for session hijacking, this flaw is categorized as high-risk, necessitating immediate remediation efforts to prevent account takeover and unauthorized platform access.",
  "technicalDetails": "The vulnerability resides in the server-side rendering logic of the /api/page/render endpoint within the Steedos Platform. This endpoint is designed to accept user-controlled input via URL query parameters, specifically 'schemaApi' and 'data'.\nThe root cause is an insecure implementation of dynamic content generation where these query parameters are reflected directly into inline <script> blocks within the rendered HTML response without adequate escaping or input validation.\nBy injecting specific script-terminating sequences (e.g., closing script tags followed by malicious code), an attacker can escape the intended script context and force the browser to execute arbitrary JavaScript payloads.\nThe attack flow begins when an attacker constructs a malicious URL incorporating the payload into the vulnerable query parameters. This URL is then distributed to targets via phishing, social engineering, or other delivery vectors. When an authenticated user clicks the link, their browser requests the /api/page/render endpoint. The Steedos server processes the tainted parameters and embeds the malicious script into the rendered page. Upon receiving the response, the victim's browser executes the injected script with the privileges of the victim's active session.\nThe scope of impact is extensive because the execution occurs within the same origin as the application. Consequently, the payload has full access to the Document Object Model (DOM), browser storage, and cookies. A primary objective of such an attack is the theft of the 'X-Auth-Token'. By accessing document.cookie or intercepting headers, the malicious code can exfiltrate this authentication token to an attacker-controlled server, facilitating session hijacking.\nBecause the /api/page/render endpoint is reachable anonymously, there are no authentication or authorization prerequisites for initiating the request. The payload execution only requires that the target user be logged into the platform at the time of the interaction. This vulnerability affects all Steedos Platform versions up to and including 3.0.15-beta.47, highlighting a critical deficiency in the input handling pipeline for client-side rendering processes."
}