Ellucian Ethos Identity logout cross site scripting
CVE-2023-2822 has a selected CVSS score of 4.3 (medium); EIP currently links 1 repository PoC, 1 Nuclei template, and 1 lab environment.
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-229596.
| Product | Source | Version range | Status |
|---|---|---|---|
Ethos IdentityBrowse Ellucian / Ethos Identity | CVE List | 5.10.0 | affected |
| 5.10.1 | affected | ||
| 5.10.2 | affected | ||
| 5.10.3 | affected | ||
| 5.10.4 | affected | ||
| 5.10.5 | affected |
A simple Flask web application containerized with Docker, intended as an intentionally vulnerable demo for CVE-2023-2822 (reflected XSS).
README.md:1-3Dockerfile:1-8The README explicitly states the application is an 'intentionally vulnerable web app to demo CVE-2023-2822' and provides build/run instructions for a Docker container.
README.md:1-3A Python Flask app with a /logout endpoint that takes a 'url' parameter, applies a weak blocklist for 'script' and 'onload', and renders the parameter unsafely in logout.html using the 'safe' filter, enabling reflected XSS.
app.py:1-17templates/logout.html:1-12Builds a container from python:3.9-slim-buster, installs Flask, copies the application code, and runs app.py on port 5000.
Dockerfile:1-8home.html provides a link to /logout; 403.html shows a blocked message; logout.html renders the 'url' parameter with the 'safe' filter, creating the XSS sink.
templates/home.html:1-12templates/403.html:1-12templates/logout.html:1-12Provides basic styling for the web pages.
static/style.css:1-23Supported by supplied evidence
The README explicitly states the app is a demo for CVE-2023-2822, and the code contains a reflected XSS vulnerability in the /logout endpoint, consistent with the CVE description.
README.md:1-3app.py:9-13templates/logout.html:9README.md:6-8app.py:9-13README.md:6-7README.md:8app.py:9-13templates/logout.html:9The application is a self-contained Flask app that listens on port 5000 inside a container. It does not attempt to escape the container, access host resources, connect to external systems, or perform any destructive actions. The XSS vulnerability is the intended lab target.
app.py:1-17Dockerfile:1-8This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.
A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely.
Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
Upgrading to version 5.10.6 is able to address this issue. It is recommended to upgrade the affected component.
Source: ProjectDiscovery