Stored cross-site scripting in the participant URL handling in AWS Ops
Wheel before PR #168 might allow an authenticated remote user to steal
session tokens a…

A stored cross-site scripting (XSS) vulnerability exists in AWS Ops Wheel prior to PR #168, specifically in the participant URL handling functionality. An authenticated remote user can exploit this by crafting a malicious participant_url value containing a dangerous URI scheme. Successful exploitation may allow the attacker to steal session tokens and escalate privileges to full administrative control of the deployed instance. The vulnerability is classified as stored XSS, meaning the malicious payload persists on the server and affects other users who encounter it. Remediation requires redeploying from the latest version of aws-ops-wheel. AWS has published a security bulletin and a GitHub security advisory addressing this issue. A pull request (#168) was issued to patch the vulnerability in the upstream repository.