Impact

A reflected cross-site scripting (XSS) vulnerability exists in github.com/libops/captcha-protect in versions prior to v1.12.2.

The challenge page accepted a client-supplied destination value and rendered it into HTML using Go's text/template. Because text/template does not perform contextual HTML escaping, an attacker could supply a crafted destination value that breaks out of the hidden input attribute and injects arbitrary script into the challenge page.

This issue can be triggered by causing a victim to visit a crafted challenge URL or any flow that reflects attacker-controlled destination input into the rendered challenge page. Successful exploitation would execute attacker-controlled JavaScript in the security context of the affected application origin.

Mitigation

This vulnerability is mitigated if your captcha-protect plugin is configured to perform challenges inline with the setting challengeURL: "". If your challenge URL is set to any other value than "" you are not using inline challenges and are impacted by this vulnerability

Patches

This issue is fixed in v1.12.2.

The fix:

• switches challenge page rendering from text/template to html/template, which applies contextual escaping for HTML attributes
• uses a typed template data structure for the challenge page
• normalizes and restricts destination before redirect use so only safe local paths are accepted

Users should upgrade to v1.12.2 or later.

Workarounds

If you cannot upgrade immediately:

• Use inline challenges with the conf challengeURL: ""
• if possible, block direct access to crafted /challenge URLs from untrusted sources until the patch is deployed

These workarounds reduce risk but do not replace upgrading to a patched release.

References

• Patch commit: eef6211
• Release containing the fix: https://github.com/libops/captcha-protect/releases/tag/v1.12.2
• Project: https://github.com/libops/captcha-protect