From beb93db8ddf635b7aa7d6ba4abf675503f3b3884 Mon Sep 17 00:00:00 2001
From: Claude <as@count.ly>
Date: Mon, 17 Aug 2026 23:54:54 +0300
Subject: [PATCH] security(core): escape "<" in the res.expose script island
 (stored XSS via app name)

The dashboard serialises the exposed countlyGlobal object into an inline
<script> block (dashboard.html: <script><%- javascript %></script>). The
serialiser only neutralised the exact sequence "</script>", but the HTML
tokeniser also ends a script element at "</script >", "</script/>" and other
whitespace/slash spellings, so an application name containing one of those
broke out of the script block. An app admin of a single app could store such
a name; any global admin who then loaded the dashboard (which lists every app)
executed the attacker's markup in their own session, escalating an app-admin
account to global-admin control.

Escape every "<" as < in both serialisation paths: string values (the
primitive branch, replacing the exact-match "</script>"/"<!--" replaces) and
object keys (escape_js_string). < parses back to "<", so every value read
from the exposed object is unchanged. This continues the value-preserving
direction of the previous fix (aa33b31, which removed the old HTML-entity
escape_html that corrupted values); it does not reintroduce entity escaping.

Also render the active-app name with .text() instead of .html() in
countly.template.js (line 2406), an independent DOM sink for the same value.

Verified: no raw "<" survives for any breakout spelling in values or keys; and
an eval round-trip of the serialiser output reproduces the input object
byte-for-byte and matches the previous serialiser's output (no dashboard-visible
change).

Reported through the security bug bounty programme (received 2026-08-17).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 CHANGELOG.md                                        |  1 +
 frontend/express/libs/express-expose.js             | 13 +++++++++----
 .../public/javascripts/countly/countly.template.js  |  2 +-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 37ace8a79ae..f67f1282275 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ Enterprise Fixes:
 - [data-manager] Fixed editing an event whose key contains `&` creating undeletable duplicate rows in the events table
 
 Security Fixes:
+- [core] The dashboard escapes `<` when serializing the exposed `countlyGlobal` object into the inline page script, so an application name (or any exposed value) containing a `</script>` end tag in any spelling can no longer break out of the script block and run in another user's session; the active-app name is now rendered with `.text()` instead of `.html()`
 - [hooks] Internal event hooks are now scoped to the apps the hook belongs to: app creation is a global-admin-only event, and remote-config, cohort, alert and hook-chaining events are only delivered when the event's app is one the hook is scoped to
 - [compliance-hub] The consents table now returns a fixed set of fields; a projection supplied on the request is no longer used to widen the response beyond the consent columns
 - [dashboards] Widgets are no longer copied when the copying user has no access to the apps they reference, and widget app ids are validated on widget create and update
diff --git a/frontend/express/libs/express-expose.js b/frontend/express/libs/express-expose.js
index 34d662e58e3..4f4340e9def 100644
--- a/frontend/express/libs/express-expose.js
+++ b/frontend/express/libs/express-expose.js
@@ -186,9 +186,13 @@ function string(obj) {
     else {
         obj = JSON.stringify(obj);
         if (obj) {
-            // Only escape things that could break out of script context
-            obj = obj.replace(/<\/script>/ig, '</scr"+"ipt>');
-            obj = obj.replace(/<!--/g, '<\\!--');
+            // Escape "<" so nothing serialized here can open or close a tag in the inline
+            // <script> block this value is written into. A "</script>" end tag terminates the
+            // script in any of its whitespace/slash spellings (</script >, </script/>, ...),
+            // which an exact-match replace of "</script>" misses; escaping every "<" closes all
+            // of those plus "<!--" and "<script". "<" parses back to "<", so runtime
+            // values read from the exposed object are unchanged.
+            obj = obj.replace(/</g, '\\u003c');
             obj = obj.replace(/\u2028/g, '\\u2028'); // Line separator
             obj = obj.replace(/\u2029/g, '\\u2029'); // Paragraph separator
         }
@@ -222,7 +226,8 @@ function escape_js_string(str) {
         .replace(/\0/g, '\\0') // Null character
         .replace(/[\u0000-\u001F\u007F-\u009F]/g, function(ch) {
             return '\\u' + ('0000' + ch.charCodeAt(0).toString(16)).slice(-4);
-        });
+        })
+        .replace(/</g, '\\u003c'); // "<" so a key cannot break out of the <script> block
 }
 
 exports = module.exports = function(app) {
diff --git a/frontend/express/public/javascripts/countly/countly.template.js b/frontend/express/public/javascripts/countly/countly.template.js
index 2873caaf92b..34c8285ff3c 100644
--- a/frontend/express/public/javascripts/countly/countly.template.js
+++ b/frontend/express/public/javascripts/countly/countly.template.js
@@ -2403,7 +2403,7 @@ var AppRouter = Backbone.Router.extend({
 
                 countlyCommon.setActiveApp(activeApp._id);
                 self.activeAppName = activeApp.name;
-                $('#active-app-name').html(activeApp.name);
+                $('#active-app-name').text(activeApp.name);
                 $('#active-app-name').attr('title', activeApp.name);
                 $("#active-app-icon").css("background-image", "url('" + countlyGlobal.cdn + "appimages/" + countlyCommon.ACTIVE_APP_ID + ".png')");
             }