Horizon Alert
Summary of the vulnerability and why it matters
A stored cross-site scripting vulnerability exists in the CustomizeUser plugin for AVideo, where a specific parameter is not properly sanitized, allowing for the injection of malicious scripts. These scripts can execute when administrators view certain pages or forms, potentially impacting users who interact with those elements. The main concern is confirming relevance and exposure for AVideo deployments.
- Malicious scripts can run on AVideo pages.
- Administrators can inject code through a plugin.
- Confirm AVideo usage and potential exposure.
Attack Path
How an attacker could exploit the issue
An attacker with limited privileges can initiate an attack by accessing the `add.json.php` endpoint within the CustomizeUser plugin. They can then inject malicious scripts through the `field_name` parameter, which is stored without proper sanitization. These scripts will execute when an administrator views specific pages or profile forms that utilize the `typeToHTML` function, potentially leading to the compromise of sensitive information or further system manipulation.
- Requires administrator-level access.
- Inject script via `add.json.php` endpoint.
- Risk of sensitive data exposure or manipulation.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could impact administrators who manage the CustomizeUser plugin within AVideo. When an administrator crafts a malicious script using the `field_name` parameter via the `add.json.php` endpoint, this script may execute when other users view extra information pages or profile forms. This could potentially affect the integrity of the web application's content and user interface presented to administrators.
- Administrator-controlled script injection.
- Scripts execute when viewing extra info pages.
- Impacts web application content integrity.
Operational Fix
Recommended remediation, mitigation, and detection steps
The stored cross-site scripting vulnerability in the CustomizeUser plugin affects AVideo, a video hosting platform. Application owners and platform teams are likely responsible for addressing this, coordinating with the vendor if necessary. The first step is to identify all instances of AVideo, confirm their exposure and business criticality, and then prioritize remediation efforts.
- Identify AVideo instances and owners.
- Verify plugin reachability and impact.
- Plan remediation based on risk.
