Is Whiteboard safe?

Question

Is Whiteboard safe?

Accepted Answer

Whiteboard is medium risk. When you enable the optional Stories feature, Whiteboard fetches story content from whiteboard-stories.herokuapp.com/stories and inserts those remote fields into UTD Blackboard pages. The DB evidence says those fields include DOM content and URLs and are rendered without sanitization or URL validation, so the story endpoint can control script-capable markup on the page.

Is Whiteboard safe?

Findings