Summary

A stored cross-site scripting (XSS) vulnerability exists in the Login Page due to improper sanitization of the authLoginCustomMessage field of the /api/auth-settings endpoint. An attacker with administrative privileges can inject arbitrary HTML/JavaScript that will be rendered on the login page for all users.

While the attack requires user interaction, it enables malicious scripts to capture credentials entered into the login form. This could allow an attacker to collect plaintext usernames and passwords before they are transmitted to the server.

This issue was reproduced using the current Docker edge build based on commit:
e6d49a2 and was found in the current latest build

Details

The login page renders the custom login message without sanitizing user-controlled HTML:

Because the loginCustomMessage (authLoginCustomMessage from the endpoint) value originates from server configuration and is inserted into the page without escaping, it allows arbitrary HTML/JavaScript execution in the browser.

Although modifying this value requires administrative privileges, any administrator account (including a compromised one) could inject a malicious payload that executes whenever a user visits the login page. This would allow the attacker to intercept credentials entered by users, even if the attacker does not otherwise have direct access to the server or its stored password hashes.

Proof of Concept

Sending a crafted request to /api/auth-settings with a malicious authLoginCustomMessage causes the payload to be rendered for all users visiting the login page.

Example payload:

{
  "authLoginCustomMessage": "<img src=\"x\" onerror=\"alert('hi')\">"
}

After this configuration is saved, the injected code executes when the login page is loaded.

The following allows an attacker to log and potentially remotely send the credentials to an attacker controlled server.

{
  "authLoginCustomMessage": "<img src=\"x\" onerror=\"document.querySelector('form')?.addEventListener('submit',()=>{const u=document.querySelector('input[name=username]')?.value;const p=document.querySelector('input[name=password]')?.value;alert('Username: '+u+' Password: '+p);});\">"
}

Impact

This vulnerability affects the login page and therefore impacts any user who accesses the server while logged out. A malicious script could capture usernames and passwords entered into the login form, potentially leading to full account compromise for affected users.