S3-Proxy allows Reflected Cross-site Scripting (XSS) in template implementation
Date: 2025-02
Affected: go/github.com/oxyno-zeta/s3-proxy/cmd/s3-proxy
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-27088
CWE: CWE-79

### Summary A Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted domain, posing a high risk to all users. ### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._ It's possible to inject html elements, including scripts through the [folder-list template](https://github.com/oxyno-zeta/s3-proxy/blob/master/templates/folder-list.tpl#L19C21-L19C38). It seems like the `.Request.URL.Path` variable is not escaped. I did some research and found it might be due to the `text/template` import being used in [the template implementation](https://github.com/oxyno-zeta/s3-proxy/blob/master/pkg/s3-proxy/utils/templateutils/template.go#L8), instead of the [safer](https://pkg.go.dev/html/template) `html/template`. ### PoC _Complete instructions, including specific configuration details, to reproduce the vulnerability._ Using the [default template configuration](https://oxyno-zeta.github.io/s3-proxy/configuration/structure/#targettemplateconfig), the vulnerability can be reproduced with the following steps. 1. Navigate to `https://your-s3-proxy.com/path-not-found` and confirm the page looks as follows: ![image](https://github.com/user-attachments/assets/1c87e274-18ec-4eb3-94fe-25bb1c0abf37) 2. Try inserting an HTML element by changing `/path-not-fou


Mitigations:

Architectural layers (MAESTRO):