Summary

XSS can be triggered via the Update Asset Index utility

PoC

1. Access setting tab
2. Create new assets
3. In assets name inject payload: "<script>alert(26)</script>
4. Click Utilities tab
5. Choose all volumes, or volume trigger xss
6. Click Update asset indexes.

XSS will be triggered

Json response volumes name makes triggers the payload

"session":{"id":1,"indexedVolumes":{"1":"\"<script>alert(26)</script>"},

It’s run on every POST request in the utility.

Resolved in 8c2ad0b