Summary

Missing access control on rendering custom (unprivileged) dojo pages causes ability for users to create stored XSS.

Details

All dojo users can create pages which allow serving arbitrary files. This can allow html files to be served and thus stored XSS can be created on the dojo's origin.

PoC

1. Create a git repository
2. Add an html file with any arbitrary JS scripts
3. Add a dojo.yml file with an entry in pages pointing to that html file
4. Commit and push the repository
5. Create or update a dojo with that repository
6. Navigate to the new custom page
7. XSS occurs

Impact

This is an XSS vulnerability where website users may perform dangerous actions without their knowledge.