CVE-2026-61791: CWE-83: Improper Neutralization of Script in Attributes in a Web Page in schorschii OCO-Server

OCO-Server versions before 1.2.1 contain a stored XSS vulnerability (CWE-83) in the Html::commandButton() function located in lib/Html.class.php. This function embeds a computer hostname into an inline JavaScript onclick handler using only htmlspecialchars(ENT_QUOTES) for HTML escaping, which browsers decode before executing the JavaScript. This allows a crafted hostname to break out of the string context and execute arbitrary script in the administrator's session. The hostname is stored via the oco.agent.hello API handler when agent self-registration is enabled (disabled by default), and the default command buttons (VNC, RDP, SSH, Ping) use the vulnerable code path. Exploitation requires possession of the shared agent-registration-key and self-registration enabled. The vulnerability is resolved in version 1.2.1.

An attacker who can register an agent with a crafted hostname can inject malicious JavaScript that executes in the context of an administrator's authenticated session. This can lead to abuse of administrative privileges, including unauthorized deployment of software jobs to managed computers. The vulnerability does not affect confidentiality or availability directly but impacts integrity and administrative control. Exploitation requires specific conditions: possession of the shared agent-registration-key and enabled agent self-registration.

Upgrade OCO-Server to version 1.2.1 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure that agent self-registration is disabled (the default setting) to prevent attackers from injecting malicious hostnames. No other specific mitigations are indicated by the vendor advisory.