CVE-2026-62368: 
PHP 취약성 분석 및 완화

CVE-2026-62368 is a stored cross-site scripting (XSS) vulnerability in Snipe-IT, an open-source IT asset and license management system. A user with the customfields.create permission can inject arbitrary HTML/JavaScript into a Custom Field name, which is rendered unescaped as a bootstrap-table column header title in asset-list pages. When any user — including a superuser — opens an affected asset-list page (e.g., /hardware), the payload executes automatically on page load, enabling session hijacking and privilege escalation. All versions prior to 8.7.0 (specifically <= 8.6.3) are affected. The vulnerability was published on August 24, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory, Snipe-IT Advisory).

The root cause is improper output encoding (CWE-79) in app/Presenters/AssetPresenter.php at line 364, where $field->name is assigned directly as the 'title' key in the bootstrap-table column layout without HTML escaping ('title' => $field->name). While Laravel's Blade {{ }} syntax encodes the data-columns attribute in the HTML output, the browser HTML-decodes the attribute value before the bootstrap-table JavaScript plugin reads it; bootstrap-table then renders the column header title without escaping because its table-level escape option defaults to false and is never enabled. The per-column 'escape' => true setting only applies to cell values, not header titles, leaving the injection point unprotected. An attacker needs only the customfields.create permission — which can be granted to non-superusers — and the malicious field must be added to a fieldset associated with an asset model so it appears in asset-list views (Github Advisory, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript within any victim's authenticated Snipe-IT browser session, exposing all same-origin data accessible to that user. The demonstrated impact includes full privilege escalation: an account holding only customfields.create (with HTTP 403 on /users) was able to issue an authenticated API request in a superuser's session to grant itself the superuser permission, resulting in complete administrative takeover. Confidentiality and integrity are both rated High (data exposure and unauthorized modification), while availability is not directly impacted (Snipe-IT Advisory).

A proof-of-concept with step-by-step reproduction instructions is publicly available in the GitHub Security Advisory, confirmed as a real exploit with high confidence by Feedly threat intelligence analysis (Snipe-IT Advisory). The NVD SSVC assessment classifies exploitation status as poc with technical impact rated total. The EPSS score is 0.0, indicating low current automated exploitation probability, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog inclusion at this time (Github Advisory). The vulnerability is not automatable (requires user interaction from a victim), but the low attack complexity and the broad exposure of the /hardware page to all authenticated users make it a practical privilege escalation path.

1. Authenticate as a low-privileged user: Log in to the target Snipe-IT instance using an account that has been granted the customfields.create permission but lacks superuser access.
2. Create a malicious Custom Field: Navigate to the Custom Fields management page and create a new Custom Field with a name containing an XSS payload, such as <img src=x onerror=alert(1)> for a basic proof-of-concept, or a more sophisticated payload like <img src=x onerror="fetch('/api/v1/users/me',{method:'POST',headers:{'X-CSRF-TOKEN':document.querySelector('meta[name=csrf-token]').content}}).then(...)"> to perform authenticated API actions.
3. Associate the field with a fieldset: Add the malicious Custom Field to a fieldset that is linked to at least one asset model, ensuring the field will appear as a column header in asset-list views.
4. Wait for a victim to load the asset list: The payload executes automatically when any authenticated user (ideally a superuser) navigates to /hardware or any other asset-list page associated with the affected fieldset — no further interaction is required.
5. Payload executes in victim's session: The browser HTML-decodes the data-columns attribute and bootstrap-table renders the header title unescaped, triggering the injected JavaScript with the victim's session cookies and CSRF tokens available.
6. Escalate privileges: The payload issues an authenticated API request (e.g., to grant the attacker's account the superuser role) using the victim's session credentials, resulting in full administrative access for the attacker (Snipe-IT Advisory).

• Logs: Web server access logs showing POST requests to the custom fields creation endpoint (e.g., /customfields) with a name parameter containing HTML tags (<, >, onerror, script, img, etc.); authenticated API requests (e.g., to /api/v1/users/{id}) originating from a superuser session shortly after that user accessed /hardware or another asset-list page.
• Application Data: Custom Field records in the database where the name column contains HTML markup or JavaScript (e.g., <img, <script, onerror=, javascript:).
• Network: Unexpected outbound HTTP requests from the Snipe-IT server or from victim browsers to external domains immediately after loading /hardware, which could indicate data exfiltration payloads.
• Privilege Changes: Audit log entries showing a non-superuser account being granted superuser privileges without a corresponding administrative action by a legitimate superuser, particularly if the change timestamp correlates with a superuser's visit to an asset-list page (Snipe-IT Advisory).

Upgrade Snipe-IT to version 8.7.0 or later, which applies the fix in commit 58754e4 by replacing 'title' => $field->name with 'title' => e($field->name) in app/Presenters/AssetPresenter.php, ensuring the field name is HTML-escaped before being passed to bootstrap-table (Patch Commit, v8.7.0 Release). As an interim workaround prior to patching, restrict the customfields.create permission exclusively to fully trusted administrators. Additionally, audit existing Custom Fields for any names containing HTML markup and remove or rename suspicious entries, and review action logs for unauthorized privilege escalation events (Github Advisory).

The vulnerability was responsibly disclosed by researcher Mickey777777 through GitHub's Security Advisory program and was published by the Snipe-IT maintainer (snipe) on August 24, 2026, with a patch released simultaneously in version 8.7.0 (Snipe-IT Advisory). The v8.7.0 release notes acknowledge 44 security fixes in total and credit multiple security researchers who reported issues responsibly, reflecting an active security engagement program (v8.7.0 Release). No significant broader media coverage or notable social media commentary specific to this CVE has been identified at this time.