A reflected Cross-site Scripting vulnerability in the Rucio WebUI allows attackers to compromise user session tokens, posing a high risk to data management integrity.

This is a reflected Cross-site Scripting (CWE-79) vulnerability occurring in the rendering of the ExceptionMessage within the WebUI 500 error page. An unauthenticated attacker can execute arbitrary scripts in a user's browser by enticing them to click a specially crafted URL, potentially leading to the theft of session tokens.

The ability for an attacker to hijack active session tokens grants them unauthorized access to the Rucio framework, which manages large volumes of scientific data. Given the CVSS score of 8.1, this vulnerability represents a high risk as it could lead to unauthorized data access, manipulation, or exfiltration by bypassing authentication mechanisms.

Immediate Action: Update the Rucio WebUI component to version 35.8.3, 38.5.4, or 39.3.1 as applicable to your current deployment branch.

Proactive Monitoring: Monitor web server access logs for anomalous URL parameters containing script tags or encoded payloads directed at 500 error pages.

Compensating Controls: Implement a strict Content Security Policy (CSP) to mitigate script execution and ensure that session cookies are flagged as HttpOnly to prevent direct access by client-side scripts.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing Rucio should prioritize patching the WebUI component to the identified fixed versions immediately. Given the ease of exploitation through reflected XSS, failure to patch leaves administrative and user accounts vulnerable to session hijacking, which could lead to significant unauthorized access within the scientific data environment.