CyberRota Analysis
AI-GeneratedOpenSearch Dashboards is vulnerable due to improper input validation in its Vega expression function, enabling remote authenticated users with write permissions to execute arbitrary JavaScript in other users' browser sessions by saving a malicious Vega visualization. This flaw arises from the failure of the validation routine to properly handle arrays of objects, allowing crafted inputs to bypass security checks. Organizations using OpenSearch Dashboards should prioritize addressing this vulnerability to mitigate the risk of cross-site scripting (XSS) attacks and protect user sessions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.