CVE-2023-45885: 
JavaScript vulnerability analysis and mitigation

A Cross Site Scripting (XSS) vulnerability was discovered in NASA Open MCT (also known as openmct) through version 3.1.0. The vulnerability was identified in November 2023 and assigned CVE-2023-45885. The vulnerability affects the flexibleLayout plugin of the Open MCT software, specifically impacting versions up to and including 3.1.0 (LinkedIn Post).

The vulnerability exists in the frame.vue:162 component of the flexibleLayout plugin, where domainObject.name is directly assigned to another component's innerHTML property without proper sanitization. The vulnerability can manifest as either Stored Client XSS or Stored Server XSS, depending on whether persistence is enabled in the system configuration. The severity of this vulnerability is rated as MEDIUM with a CVSS v3.1 Base Score of 5.4 (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) (NVD).

The impact of this vulnerability is heightened due to the lack of Content Security Policy (CSP) flags and CSRF protection in the examined version. This allows attackers to potentially execute arbitrary JavaScript code, fetch malicious code from remote servers, and execute it in the user's web browser context. The vulnerability could lead to data exfiltration and unauthorized actions in the application (LinkedIn Post).

The vulnerability can be exploited by creating a new component within the flexibleLayout and injecting an XSS payload in the component's title. When the flexibleLayout is in edit mode and the user drags elements between columns, the XSS payload is triggered. The lack of CSP makes the exploitation more severe as it allows the execution of remote JavaScript code (LinkedIn Post).

The recommended mitigation includes implementing proper sanitization methods, such as the one already used in the Notebook plugin (NotebookEntry.vue:246). Additionally, it is recommended to implement Content Security Policy (CSP) based on the OWASP cheat sheet and implement CSRF countermeasures (LinkedIn Post).