A vulnerability in Kohler HotCRP allows authenticated users to execute arbitrary JavaScript in other users' browsers through maliciously crafted document uploads, posing a significant risk to session integrity.

This is a cross-site scripting (XSS) vulnerability (CWE-79) triggered by the improper handling of Content-Disposition headers during file delivery. An authenticated attacker can upload malicious HTML or SVG files that execute scripts in the viewer's browser, potentially allowing the attacker to perform actions on behalf of the victim via the HotCRP API.

The exploitation of this vulnerability could lead to the total compromise of an authenticated user's session, including the theft of credentials or unauthorized access to sensitive conference review data. With a CVSS score of 7.3, this flaw represents a High severity risk, as it facilitates unauthorized actions within the application and potential data exfiltration, directly impacting the confidentiality and integrity of the review process.

Immediate Action: Update the HotCRP instance to the version containing commit 8933e86c9f384b356dc4c6e9e2814dee1074b323 or newer to ensure correct Content-Disposition header enforcement.

Proactive Monitoring: Review web server logs for suspicious file upload activity or unusual requests targeting document URLs with parameters that force inline rendering.

Compensating Controls: Implement a Content Security Policy (CSP) that restricts script execution and prevents the loading of untrusted documents, or disable the ability for users to upload HTML and SVG file types until the patch is applied.

Public Exploit Available: No

Given the potential for session hijacking and API abuse, it is imperative that administrators upgrade their HotCRP installation immediately. Organizations should prioritize patching this vulnerability to prevent the execution of malicious scripts within their conference review environment and protect user credentials from compromise.