Stored XSS via Unescaped License Attribution Fields

Summary

Severity

• Low-privilege attacker (any authenticated non-temporary user)
• Stored XSS — persists in database
• Triggers on a public page (no authentication needed to view)
• Can steal session cookies, perform actions as other users, redirect to phishing

CWE

Affected Components

Vulnerable Property

@property
def attribution link(self):
  out = ''
  if self.license object url:
    out += f'<a href="{self.license object url}">{self.license title}</a>'
  else:
    out += self.license title # NO ESCAPING
  out += ' by '
  if self.license author url:
    out += f'<a href="{self.license author url}">{self.license author}</a>'
  else:
    out += self.license author # NO ESCAPING
  out += f' is licensed under <a href="{self.license.url}">{self.license.short name}</a>'
  if self.license derivative source url:
    out += (
      f'/ A derivative work from <a href="{self.license derivative source url}">the '
      f'original work</a>'
    )
  return out

Unsafe Template Rendering

• Line 171: {{ ingredient.attribution link|safe }}
• Line 226: {{ image.attribution link|safe }}

Writable Entry Point

class IngredientCreateView(WgerFormMixin, CreateView):
  model = Ingredient
  form class = IngredientForm # includes license author field

Models Affected

• Exercise, ExerciseImage, ExerciseVideo, Translation (exercises module)
• Ingredient, Image (nutrition module)

Root Cause

1. attribution link constructs raw HTML by string interpolation of user-controlled fields without calling django.utils.html.escape() or django.utils.html.format html()
2. The template renders the result with |safe, bypassing Django's auto-escaping
3. The license author field in IngredientForm has no input sanitization
4. The set author() method only sets a default value if the field is empty — it does not sanitize user-provided values

Reproduction Steps (Verified)

Prerequisites

• A wger instance with user registration enabled (default)
• An authenticated user account (non-temporary)

Steps

1. Register/login to a wger instance
2. Create a malicious ingredient via the web form at /en/nutrition/ingredient/add/:

• Set Name to any valid name (e.g., "XSS Form Verified")
• Set Energy to 125, Protein to 10, Carbohydrates to 10, Fat to 5 (energy must approximately match macros)
• Set Author(s) (license author) to:

<img src=x onerror="alert(document.cookie)">

• Submit the form — the form validates and saves successfully with no sanitization

3. View the ingredient page (public URL, no auth needed):

• Navigate to the newly created ingredient's detail page
• The XSS payload executes in the browser

Verified PoC Output

<small>
   by <img src=x onerror=alert(1)> is licensed under <a href="https://creativecommons.org/licenses/by-sa/3.0/deed.en">CC-BY-SA 3</a>
</small>

Alternative API Path (ExerciseImage)

# Upload exercise image with XSS in license author
curl -X POST https://wger.example.com/api/v2/exerciseimage/ 
 -H "Authorization: Token <token>" 
 -F "exercise=1" 
 -F "image=@photo.jpg" 
 -F 'license author=<img src=x onerror="alert(document.cookie)">' 
 -F "license=2"

Impact

• Session hijacking: Steal admin session cookies to gain full control
• Account takeover: Modify other users' passwords or email addresses
• Data theft: Access other users' workout plans, nutrition data, and personal measurements
• Worm-like propagation: Malicious ingredient could inject XSS that creates more malicious ingredients
• Phishing: Redirect users to fake login pages

Suggested Fix

from django.utils.html import format html, escape

@property
def attribution link(self):
  parts = []

  if self.license object url:
    parts.append(format html('<a href="{}">{}</a>', self.license object url, self.license title))
  else:
    parts.append(escape(self.license title))

  parts.append(' by ')

  if self.license author url:
    parts.append(format html('<a href="{}">{}</a>', self.license author url, self.license author))
  else:
    parts.append(escape(self.license author))

  parts.append(format html(
    ' is licensed under <a href="{}">{}</a>',
    self.license.url, self.license.short name
  ))

  if self.license derivative source url:
    parts.append(format html(
      '/ A derivative work from <a href="{}">the original work</a>',
      self.license derivative source url
    ))

  return mark safe(''.join(str(p) for p in parts))

References

• Django Security: Cross Site Scripting (XSS) protection
• [Django format html() documentation](https://docs.djangoproject.com/en/5.0/ref/utils/#django.utils.html.format html)
• OWASP: Stored Cross-Site Scripting