A stored XSS vulnerability in the Rucio WebUI allows authenticated attackers to execute arbitrary JavaScript, posing a significant risk of session theft and unauthorized account actions.

The application fails to properly sanitize user-controlled input within the Custom Rules function, leading to stored Cross-Site Scripting (XSS). This flaw permits an authenticated user to persist malicious scripts that execute when viewed by other users in the WebUI.

Successful exploitation allows an attacker to compromise the sessions of legitimate users, including administrative accounts, potentially leading to unauthorized data access or management policy changes. With a CVSS score of 7.3, this high-severity vulnerability highlights the risk of privilege escalation and loss of data integrity within the scientific data management framework.

Immediate Action: Update Rucio to version 35.8.3, 38.5.4, or 39.3.1 immediately to resolve the improper output encoding.

Proactive Monitoring: Review web application access logs for unusual patterns in Custom Rules submissions and monitor for anomalous JavaScript execution or unexpected session behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads directed at the Custom Rules input fields.

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available.

Given the potential for session hijacking and unauthorized data manipulation, organizations must prioritize upgrading to the patched Rucio versions. Ensure that all users with access to the WebUI are educated on the risks of untrusted input and verify that security updates are applied across all production instances without delay.