Portainer: Self-XSS

### Summary Portainer 2.16.0 and above are affected by a self-XSS vulnerability in the updateUser function of the [UserController](https://github.com/portainer/portainer/blob/e66dea44e3dcf102e9335ba97cd47478ed56e497/app/portainer/views/users/edit/userController.js) controller. The function does not sanitize the oldUsername or username variables passed to the message argument. ### Severity Low - The function does not sanitize variables passed to the message argument creating a xss. ### Proof of Concept Steps to reproduce: 1. Authenticate to Portainer as an administrative user 2. Create a user. The name can optionally contain an XSS payload such as <script>alert(1)</script>. 3. Go to the Users page and click on the username. The resulting page will have a form for changing the username. In that pane, input the new username containing a payload (if the existing name contains a payload, this is optional. If both the former and new username contain payloads, both will be executed). 4. Press “Save” and the payload(s) will be executed. The following screenshot shows a username change (whose original username was <script>alert(4)</script> and modified username was asdf<script>alert(4)</script>) after the “Save” button was pressed. The payload is triggered. ### Timeline **Date reported**: 3/20/2023 **Date fixed**: 4/18/2023 **Date disclosed**: 6/20/2023

Severity from

GitHub (reviewed advisory)

• github.com/google/security-research/security/advisories/GHSA-8x95-jcmc-4gh5
• github.com/google/security-research