Stored XSS via HTML scrubber rule in RTIR
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.0.11, 6.0.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
RTIR, an add-on for the Request Tracker ticketing system, has a flaw in its HTML filtering rules that lets malicious links with executable scripts be saved in tickets across the entire RT instance. An attacker, including an anonymous sender of email to the publicly open Incident Reports queue, could cause a script to run in a victim's browser when they click the link, allowing it to perform actions in RT with that user's permissions.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own queues. Anyone who can add HTML content to a ticket on such an instance can store such a link. That includes an unauthenticated sender of HTML email to the Incident Reports queue, which RTIR opens to everyone by default. Script runs when a user clicks the link, in that user's session, and can act in RT with that user's authority. This issue was fixed in version 5.0.11 and 6.0.4
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Best Practical Solutions RT for Incident Response
From 5.0.0 · fixed in 5.0.11; From 6.0.0 · fixed in 6.0.4