CVE-2023-47115 is a high-severity cross-site scripting (XSS) vulnerability affecting HumanSignal's open-source data labeling tool, Label Studio, in versions prior to 1.9.2. The vulnerability arises from improper input neutralization during web page generation, specifically in the handling of user-uploaded avatar images. An authenticated user can upload a crafted image file containing malicious HTML/JavaScript code disguised as an image. The vulnerability stems from insufficient server-side validation: the application only verifies the file as an image by extracting its dimensions, but does not enforce strict file extension validation on the server side. Instead, file extension checks are performed client-side, which attackers can bypass. Furthermore, Label Studio uses Django's built-in 'serve' view to deliver avatar images. This view determines the Content-Type header based on the file extension in the URL path, not the actual file content. Consequently, if an attacker uploads a file with a '.html' extension containing malicious JavaScript, the server serves it as an HTML page, enabling script execution in the context of the victim's browser. This XSS can be exploited when a user, including administrators, views the crafted avatar image. For example, an attacker could inject JavaScript that creates a new Django super administrator account if a Django admin visits the malicious avatar. This elevates the risk from a typical XSS to a potential full compromise of the Label Studio instance. The vulnerability is fixed in version 1.9.2. Recommended mitigations include enforcing server-side validation of file extensions, replacing Django's 'serve' view with a secure controller for serving uploaded avatars, storing uploaded files in a database rather than the filesystem to reduce file-related risks, and generally avoiding trust in user-controlled inputs. No known exploits are reported in the wild as of the publication date.

For European organizations using Label Studio versions prior to 1.9.2, this vulnerability poses a significant risk. Successful exploitation can lead to arbitrary JavaScript execution in the context of authenticated users, including administrators. This can result in unauthorized privilege escalation, data manipulation, and potential full system compromise. Given Label Studio's role in data labeling, often used in machine learning workflows, compromise could lead to data integrity issues, leakage of sensitive datasets, or sabotage of AI training processes. The impact extends beyond confidentiality to integrity and availability, as attackers could inject malicious code to alter or delete data or disrupt operations. Organizations in sectors such as finance, healthcare, automotive, and research using Label Studio for sensitive data annotation are particularly at risk. The requirement for authentication and user interaction (visiting the malicious avatar) somewhat limits exploitation scope but does not eliminate risk, especially in environments with multiple users and administrators. The vulnerability's high CVSS score (7.1) reflects these risks. Additionally, the use of Django's insecure 'serve' view in production environments is a common misconfiguration that may be prevalent in European deployments, increasing exposure.

1. Upgrade Label Studio to version 1.9.2 or later immediately to apply the official patch addressing this vulnerability. 2. Implement strict server-side validation of uploaded file extensions and MIME types, rejecting any files that do not conform to expected safe image formats (e.g., .png, .jpg, .jpeg, .gif). 3. Replace Django's built-in 'serve' view with a secure, custom controller that explicitly sets Content-Type headers based on verified file content rather than file extension, preventing HTML rendering of uploaded files. 4. Consider storing uploaded avatar images in a database or object storage with controlled access rather than directly on the filesystem to reduce file-related attack vectors. 5. Conduct regular security audits of file upload functionalities and ensure client-side validations are complemented by robust server-side checks. 6. Educate users and administrators about the risks of clicking on suspicious avatar images or links within the platform. 7. Monitor logs for unusual avatar upload patterns or access to avatar URLs with unexpected file extensions. 8. If upgrading immediately is not feasible, implement web application firewall (WAF) rules to detect and block requests serving avatar images with '.html' or other suspicious extensions. 9. Review and harden Django configurations to avoid using development-only features like 'serve' in production environments.