Label Studio XSS Vulnerability on Avatar Upload

CVE-2023-47115

What is CVE-2023-47115?

Label Studio, an open-source data labeling tool, has a vulnerability that can be exploited through cross-site scripting (XSS). This vulnerability exists in versions prior to 1.9.2, primarily when an authenticated user uploads a crafted image file for their avatar. If successful, the attacker's JavaScript payload can execute in the context of the Label Studio application, leading to potential malicious actions against users who visit the crafted avatar. The vulnerability arises from inadequate server-side validation of file types, relying instead on client-side checks that can easily be bypassed. Attackers can assign a malicious HTML file a .html extension, allowing it to be rendered as a web page. The issue can be mitigated through several strategies, including proper server-side validation, removal of the insecure Django serve view for serving avatar images, and implementing secure handling of user-uploaded images.

References