Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and below, a stored Cross-site Scripting (XSS) vulnerability in the web dashboard's User Mapping dropdown allows any unprivileged Discord user in the configured guild to execute arbitrary JavaScript in the Anchorr admin's browser. By chaining this with the GET /api/config endpoint (which returns all secrets in plaintext), an attacker can exfiltrate every credential stored in Anchorr which includes DISCORD_TOKEN, JELLYFIN_API_KEY, JELLYSEERR_API_KEY, JWT_SECRET, WEBHOOK_SECRET, and bcrypt password hashes without any authentication to Anchorr itself. This issue has been fixed in version 1.4.2.
The stored XSS vulnerability is located in the User Mapping dropdown menu in the Anchorr web panel. Any Discord user belonging to the configured server (guild) can inject a malicious JavaScript payload, which is saved server-side and executed in the administrator's browser each time the panel is opened. The executed script can then send a request to the GET /api/config endpoint, which returns all application secrets in plaintext without requiring any authentication. The combination of these two weaknesses (CWE-79 and CWE-200) creates a critical attack chain enabling complete theft of authentication data.
An attacker can exfiltrate all credentials stored in Anchorr, including Discord tokens (DISCORD_TOKEN), Jellyfin and Jellyseerr API keys, JWT secrets and webhooks, as well as bcrypt password hashes, thereby gaining full control over the integrated media infrastructure.
Anchorr should be updated to version 1.4.2, in which the vulnerability has been fixed. The patch is available in the project's GitHub repository (tag v1.4.2). Until the update is applied, it is recommended to restrict access to the administration panel only to trusted networks and to rotate all secrets and API keys stored in the Anchorr configuration.
Anchorr (openVESSL/Anchorr) in versions 1.4.1 and earlier
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpenvessl Anchorr
APPOpenvessl≤ 1.4.1