Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver

The XSS vulnerability in btcpayserver allows an attacker to inject arbitrary JavaScript code into web pages served by the application. This code can then be executed in the context of a victim's browser, granting the attacker access to sensitive information such as cookies, session tokens, and other user data. An attacker could also use this vulnerability to redirect users to malicious websites, deface the application, or perform other actions on behalf of the victim. The impact is particularly concerning for btcpayserver deployments handling cryptocurrency transactions, as compromised user accounts could lead to financial losses.

Organizations and individuals running btcpayserver versions 1.2.3 or earlier, particularly those handling sensitive financial data or operating in environments with limited security controls, are at risk. Shared hosting environments where multiple users share the same btcpayserver instance are also particularly vulnerable.

• generic web: Use curl/wget to test for reflected XSS payloads in input fields.

curl 'http://btcpayserver/search?q=<script>alert(1)</script>'

• generic web: Examine access/error logs for suspicious requests containing JavaScript code. • generic web: Check response headers for Content-Security-Policy (CSP) directives. Lack of CSP increases XSS risk.

1. 2021-09-26Disclosure

   disclosure

1. Reservado2021-09-26
2. Publicada2021-09-26
3. Modificada2024-08-03
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2021-3830 is to upgrade btcpayserver to version 1.2.3 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on user-supplied data to prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update your btcpayserver configuration to ensure it adheres to security best practices.