GHSA-99c7-c3mw-mxhv: ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal

The analysis started by identifying the patched version for the vulnerability in the ezsystems/ezplatform-admin-ui package, which is 2.3.39. By comparing the tags for the patched version and the last vulnerable version (v2.3.38), I identified the commit da3bfbfbc47d322cf052b14bf609858b6ddee5c7 which has a message indicating it's a security fix: "[Security] IBX-10200: Fix XSS in reschedule/cancel-schedule modal".

Analyzing the changes in this commit revealed a critical modification in the file src/bundle/Resources/public/js/scripts/fieldType/ezimageasset.js. The code was changed from using assetNameContainer.innerHTML = destinationContentName; to assetNameContainer.innerText = destinationContentName;. This is a standard and effective mitigation for XSS vulnerabilities.

The vulnerable code was located within the _updatePreview method of the EzImageAsset class. This function is responsible for updating the preview of an image asset, and it was using the potentially malicious asset name (destinationContentName) to directly manipulate the DOM via innerHTML.

Therefore, the function EzImageAsset._updatePreview is identified as the vulnerable function. An attacker could exploit this by crafting a malicious image asset name, which would then be executed in the browser of a user viewing the asset preview in the back office.