Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

The impact of this XSS vulnerability is significant, particularly given the sensitive nature of research data often stored within eLabFTW. A successful attacker can leverage the injected JavaScript to perform a wide range of malicious actions within the context of the affected user's session. This includes, but is not limited to, stealing API keys for persistent access, modifying experiment data, and potentially gaining administrative privileges if the targeted user holds a sysadmin role. The ability to act as a sysadmin grants complete control over the eLabFTW instance, allowing for data exfiltration, system compromise, and disruption of research activities. The ease of triggering the vulnerability by simply viewing a list of experiments amplifies the potential for widespread exploitation.

1. आरक्षित2024-03-04
2. प्रकाशित2024-09-02
3. संशोधित2024-09-03
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-28100 is to immediately upgrade eLabFTW to version 5.0.0 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious file uploads based on known patterns or content types associated with XSS payloads. Additionally, carefully review and sanitize any user-uploaded files before storing them within the eLabFTW system. Regularly audit user permissions and restrict access to sensitive functionalities, such as API key generation, to minimize the potential impact of a successful attack. After upgrading, confirm the fix by attempting to upload a known malicious file and verifying that the JavaScript code is not executed.