SECURITY: [Homarr] XSS vulnerability

[CrazyWolf13]

Hi,

Forwarding an important note from Homarr Team.

I'd like to notify you of a high-severity vulnerability within Homarr. If you updated to >=1.43.3, you're already safe and no action is needed.
For 1.43.2and any previous release, please update as soon as possible.

Short summary of CVE
[GHSA-wj62-c5gr-2x53](https://github.com/homarr-labs/homarr/security/advisories/GHSA-wj62-c5gr-2x53) allows XSS using the user medias and the iframe widget. An attacker can abuse these to escalate to administrator privileges, distribute malware or perform phishing.

Why is this advisory after the release?
We were in close communication with the reporter of the vulnerability and decided to postpone the publishing, so most instances have been updated to a fixed version. This reduces the risk of bad actors taking advantage of the CVE.

How has the vulnerability been remedied?
We implemented sanitazation for the user media files. It removes any malicious content before it is sent to the user and we confirmed with the reporter that the exploit is no longer possible
We hardened the security of the iframe widget (also see [#4499](https://github.com/homarr-labs/homarr/issues/4499)). We manually confirmed that this fixed the vulnerability.

How do I know if I was affected?
It is unlikely that this vulnerability was actively exploited, as it was not publicly known until today. Privilege escalation can be seen in the Web UI (e.g. some random users have admin?).
We can also confirm that no passwords or no secrets (e.g. API tokens, ...) have been leaked, since they are encrypted in the database and the reported vulnerability did not make it possible to decrypt them in any way.

What is next?
Vulnerabilities are part of software-development. We reacted as fast as possible and were in close contact with the [reporter](https://github.com/acfirthh). As a general guideline, it's always recommended to rotate credentials frequently and block any untrusted users from accessing your network (e.g. only allow access within your local network and do not expose it).

------

We take security seriously and will continue to react to advisories. Please [report vulnerabilities using our policy](https://github.com/homarr-labs/homarr/security/policy) if you encountered any and we'll be happy to look into them with you.

See you soon again 👋

Github Advisory: GHSA-wj62-c5gr-2x53

Source: Homarr Discord: (https://discord.com/channels/972958686051962910/974370615752531988/1440629955548680284) Invite Link: https://discord.gg/aCsmEV5RgA

Thanks again to @manuel-rw @Meierschlumpf and the Homarr Team for this quick fix and the public note!

[manuel-rw]

Happy to answer any questions below 👇