Admin UI - User Creation XSS Vulnerability

[sarkalgud-b]

We are using the Duende Admin Module out of the box for our project.
We noticed that Admin UI - User Creation Screen "Phone Number" field is exposed to XSS attacks..
Looking at the Admin UI code on GitHub, we noticed that there is no "asp-validation-for" attribute on the Phone Number input tag (or an associated span tag for the phone number).
Is there a fix that could be provided?

[damianh]

Looking at the Admin UI code on GitHub

Can you provide the link please?

[sarkalgud-b]

The link to the UserProfile.cshtml
https://github.com/skoruba/Duende.IdentityServer.Admin/blob/main/src/Skoruba.Duende.IdentityServer.Admin.UI/Areas/AdminUI/Views/Identity/UserProfile.cshtml

[damianh]

That repository/code is neither owned nor managed by us. You need to contact the author at https://github.com/skoruba/Duende.IdentityServer.Admin/issues . Thank you.

[sarkalgud-b]

Is there a Duende Software equivalent of "Skoruba.Duende.IdentityServer.Admin.UI" that we can use ?

[damianh]

We have an IdentityServer Admin UI in our templates. However the Admin UI you have in your screen shot is related to administrating Asp.Net Core Identity which we do not support directly.

[skoruba]

@sarkalgud-b - I am checking your report and I am not able to reproduce it. Please, share more information here: skoruba/Duende.IdentityServer.Admin#266
Thanks!