Vikunja Vulnerable to XSS Via Task Preview

Summary

The task preview component creates a unparented div. The div's innerHtml is set to the unescaped description of the task

Details

In the TaskGlanceTooltip.vue it temporarily creates a div and sets the innerHtml to the description here. Since there is no escaping on either the server or client side, a malicious user can share a project, create a malicious task, and cause an XSS on hover.

PoC

1. Create a project
2. Create a task with any description
3. Use the api to update the task with a description containing unescaped HTML (ex: <img src=x onerror="alert(localStorage.getItem('token'))">
4. Share the project with any permission level
5. Send malicious project to user and ask them to view task

Impact

Any user on an instance can cause an XSS on another