What’s Vulnerable › Vulnerabilities

CVE-2026-61728: SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover

Description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snapshots preceding the respective 0.1.70 and 0.1.76 sink repairs, portal users, including `customer_user`, can submit stored markup through `POST /api/incidents/db_operations/alert/comment`. In `customer-portal/src/components/alerts/AlertDetails/AlertComment.vue`, `commentHtml` replaces newlines in `comment.comment` but passes the result to `v-html` without escaping or sanitizing HTML. When another user views the poisoned alert, stored script executes on the application origin; the same unsanitized rendering pattern affects server-stored SOC case, asset and health-check fields in `SocCaseNote.vue`, `SocCaseItem.vue`, `SocCaseAssetsItem.vue`, `SocAlertAssetsItem.vue` and `HealthcheckItem.vue`. The authentication store in `customer-portal/src/stores/auth.ts` persists both access and refresh tokens in JavaScript-readable storage, and `customer-portal/src/api/httpClient.ts` uses bearer headers rather than HttpOnly cookies. An injected script can steal both tokens, impersonate the viewer and obtain fresh tokens through `/auth/refresh`. If an analyst or administrator views the poisoned alert or case, this enables persistent privileged account takeover, cross-tenant data access, incident modification or deletion, and detection/response subversion. The health-check sink repair is first contained in version 0.1.70, while the comment and other SOC sink repairs are first contained in version 0.1.76. Version 0.1.76 is the provisional first release containing all observed repairs; grouped versus split CVE scope requires curator adjudication.

Summary

SOCFortress CoPilot suffers from stored cross-site scripting: portal users, including customer_user, can submit markup via POST /api/incidents/db_operations/alert/comment, and AlertComment.vue renders commentHtml with v-html without escaping or sanitizing. The same unsanitized pattern affects server-stored SOC case, asset and health-check fields. Because access and refresh tokens are kept in JavaScript-readable storage and sent as bearer headers, injected script can steal both tokens, impersonate an analyst or administrator who views the poisoned content, and refresh them, enabling persistent privileged account takeover, cross-tenant data access, and incident tampering. Affected are snapshots preceding the 0.1.70 and 0.1.76 sink repairs; the health-check fix is first in 0.1.70 and the comment and other SOC sink fixes in 0.1.76, which is the provisional first release with all observed repairs. No exploitation is reported and it is not in CISA KEV. Upgrade to 0.1.76 (or at minimum 0.1.70 for the health-check sink) and, until patched, restrict portal comment access and avoid opening untrusted alerts and cases.

يعاني SOCFortress CoPilot من ثغرة XSS مخزّنة، إذ يستطيع مستخدمو البوابة، بمن فيهم customer_user، إرسال تعليمات HTML عبر POST /api/incidents/db_operations/alert/comment، ويعرض AlertComment.vue الحقل commentHtml عبر v-html دون تهريب أو تعقيم. ويؤثر النمط غير المعقّم نفسه في حقول حالات SOC والأصول وفحوص الصحة المخزّنة على الخادم. ولأن رموز الوصول والتحديث تُحفظ في تخزين يقرأه JavaScript وتُرسل كترويسات bearer، يمكن للسكربت المحقون سرقة الرمزين وانتحال هوية المحلل أو المسؤول الذي يعرض المحتوى الملوّث وتحديث الرموز، ما يتيح استيلاءً مستمراً على حسابات ذات صلاحيات ووصولاً إلى بيانات مستأجرين آخرين وتلاعباً بالحوادث. تتأثر اللقطات السابقة لإصلاحات 0.1.70 و0.1.76؛ إصلاح فحص الصحة أولاً في 0.1.70، وإصلاحات التعليقات وحقول SOC الأخرى أولاً في 0.1.76، وهو أول إصدار مؤقت يحتوي جميع الإصلاحات المرصودة. لا يُبلّغ عن استغلال فعلي وليست في CISA KEV. رقّوا إلى 0.1.76 (أو 0.1.70 كحد أدنى لإصلاح فحص الصحة)، وإلى حين الترقية قيّدوا الوصول إلى تعليقات البوابة وتجنبوا فتح التنبيهات والحالات غير الموثوقة.

Affected products

References

Get alerted when CVE-2026-61728 or the next vulnerability affects your stack