Stored XSS in Amundsen Frontend

Amundsen frontend versions through 4.3.0 contain a Stored Cross-Site Scripting (XSS) vulnerability due to the improper use of React's dangerouslySetInnerHTML property. The application fails to sanitize table, dashboard, or feature descriptions rendered within ResourceListItem components. This allows an attacker who can influence the metadata ingested into Amundsen - typically via the metadata service or the underlying Elasticsearch index - to inject malicious HTML content. When a legitimate user views search results containing these compromised descriptions, the injected scripts (e.g., img elements with onerror handlers) execute within the context of the user's session. This could lead to credential theft, session hijacking, or unauthorized actions performed on behalf of the victim user within the Amundsen interface.

Impact

Successful exploitation results in arbitrary JavaScript execution in the browser of any user who views search results containing malicious descriptions. This impacts all organizations using Amundsen frontend 4.3.0 or earlier, potentially exposing internal data lineage and business intelligence metadata to unauthorized manipulation or exfiltration.

Recommendation

Prioritized actions for security teams:

• Update the Amundsen frontend to a version beyond 4.3.0 that implements HTML sanitization for description fields.
• Audit metadata sources (metadata service, Elasticsearch) to identify and remove existing malicious payload strings in table or dashboard descriptions.
• Implement a Content Security Policy (CSP) that restricts script execution to trusted domains to mitigate the impact of XSS, even if rendering logic remains flawed.
• Restrict write access to the metadata service and the Elasticsearch backend to authorized service accounts only to prevent unauthorized injection.