CVE-2022-2589: Reflected XSS on conversion filter function in fava

Description

Fava v1.22 have a conversion filter function on income statement dashboard which allow user to perform XSS due to improper validation on filter conversion.

Proof of Concept

1. Navigate to Fava demo instance https://fava.pythonanywhere.com/example-beancount-file/income_statement/.
2. Filter on conversion type and add payload on the result.
3. Hover mouse cursor to bar chart (visualization) and XSS alert will pop up.

Endpoints

• https://fava.pythonanywhere.com/huge-example-file/income_statement/?conversion=at_value
• https://fava.pythonanywhere.com/example-with-budgets/income_statement/?conversion=units
• https://fava.pythonanywhere.com/example-beancount-file/income_statement/?conversion=at_value

Payload

1. "><img src=a onerror=alert(document.domain)>

Screenshot POC

1. xss domain
2. xss

Impact

This vulnerability is capable of executing a malicious javascript code in web page

Occurrences