Listen to this Post
Prowler’s HTML output formatter in `prowler/lib/outputs/html/html.py` inserts `finding.resource_tags` into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler HTML report, the payload executes in the report page. This is stored cross-site scripting in a security report artifact. The attacker needs permission to influence tags on a scanned cloud resource, and the victim must open the generated HTML report. In that context, JavaScript can read and modify the report DOM, alter displayed findings, and interact with any same-origin local or hosted report content available to the browser. This can undermine trust in generated security findings and can expose data contained in the report page. The vulnerable sink is present in current master at commit 329dfdf8e6cb8bc0424fb54b6595408e20969782 and in the latest GitHub release tag 5.28.0. The package metadata identifies the Python package as prowler. The HTML formatter builds each finding row with an f-string in prowler/lib/outputs/html/html.py. Neighboring fields are explicitly escaped: `resource_uid` is escaped at line 85 with `.replace(“<", "<").replace(">“, “>”)` and `status_extended` is escaped at line 87 with the same pattern. The tag column does not apply equivalent escaping: <td>{parse_html_string(unroll_dict(finding.resource_tags))}</td>. `unroll_dict` concatenates tag keys and values into a string, and `parse_html_string` only prefixes each item with an HTML bullet. Neither function escapes <, >, quotes, or event-handler attributes before insertion into the table cell. As a result, a tag value such as `` remains active markup in the generated report.
DailyCVE Form:
Platform: Prowler
Version: < 5.37.0
Vulnerability: Stored XSS
Severity: Medium (CVSS 5.4)
Date: 2026-08-12
Prediction: 2026-08-12
What Undercode Say:
Check Prowler version prowler --version Generate an HTML report (vulnerable versions) prowler -M html -o report.html Check if resource_tags are present in the HTML output grep -E "resource_tags|Owner=" report.html View unescaped tags in the report cat report.html | grep -A5 -B5 "window.PROWLER_TAG_XSS"
Exploit: (Educational Purposes!)
- Identify a cloud resource that Prowler will scan (e.g., an EC2 instance, S3 bucket).
- Add a tag with a malicious payload. For example, set a tag `Owner` to:
`
`
- Run Prowler against the account and generate an HTML report.
- Open the generated HTML report in a browser. The payload will execute from the tags column.
- The browser proof result will show
{"tag": 1, "uid": 0, "status": 0, "attr": "1"}, confirming that the `resource_tags` payload executed while the `resource_uid` and `status_extended` payloads did not.
Protection:
Upgrade to Prowler version 5.37.0 or later. The fix ensures that tag keys and values are properly HTML-escaped before insertion into the HTML output. A single HTML escaping helper should be used for every finding field that can originate from provider data. If bullets or separators are needed, build the list structure after escaping each key and value, rather than escaping the final HTML string after markup has been added.
Impact:
- Loss of Trust: Security reports can be altered to hide or fabricate findings, undermining confidence in the security posture of the cloud environment.
- Data Exposure: JavaScript can read and exfiltrate sensitive data contained within the report page.
- DOM Manipulation: The report’s DOM can be modified, potentially leading to further client-side attacks or misleading visual representations of security status.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
