Giters

awslabs / aws-js-s3-explorer

AWS JavaScript S3 Explorer is a JavaScript application that uses AWS's JavaScript SDK and S3 APIs to make the contents of an S3 bucket easy to browse via a web browser.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

xss injection

53n4d opened this issue · comments

commented

Hi, how are you?

I want to report xss vulnerability in aws s3 explorer. POC is below:

Click on the settings icon in the top right corner. Popup will open to enter S3 bucket name.
Type a payload as you can see on this image, and press enter:

Screenshot from 2024-03-05 14-31-14

And you'll get an xss:
Screenshot from 2024-03-05 14-31-23

commented

Thanks for the report and a quick way to repro the problem.

commented

Just to inform, i reported this to: https://cveform.mitre.org/ as a cve request, to inform users about affected version, because xss is usually high or critical vulnerability.

Thank you for your prompt response and quick fix.