A stored cross-site scripting vulnerability in the Amundsen frontend allows authenticated attackers to execute arbitrary JavaScript in the browsers of other users, posing a significant risk of session hijacking.

The application utilizes the dangerouslySetInnerHTML property in the ResourceListItem component to render metadata descriptions without adequate sanitization. An authenticated attacker can inject malicious payloads, such as img elements with onerror handlers, into the metadata service or Elasticsearch, which then execute in the context of any user who views the affected search results.

This vulnerability carries a CVSS score of 7.6, categorizing it as high severity. Successful exploitation allows unauthorized execution of scripts within the context of a victim session, potentially leading to the theft of session tokens, unauthorized actions performed on behalf of the user, or the exposure of sensitive metadata accessed by the Amundsen platform.

Immediate Action: Upgrade the Amundsen frontend to a version beyond 4.3.0 once a patched release is made available by the vendor. In the absence of an immediate patch, sanitize all incoming data at the metadata service or Elasticsearch ingestion layer to ensure no malicious HTML or script tags are stored.

Proactive Monitoring: Review access logs for unusual patterns in metadata updates, specifically looking for attempts to inject HTML or script tags into table, dashboard, or feature descriptions.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block common XSS payloads, particularly focusing on the request parameters associated with metadata updates.

Public Exploit Available: No

Given the high CVSS score and the potential for lateral movement via session compromise, this vulnerability should be prioritized for remediation. Organizations using Amundsen should immediately audit their metadata ingestion processes to prevent the storage of malicious payloads and monitor vendor channels for the release of an official patch.