[Bug]: Potential stored XSS

[artemy-ccrsky]

Describe the bug

Creating/editing module we can edit main.vue, so it leads to stored XSS and also potential impact for interact with WebSocket using valid origin.
Potential impact: Low privilege user affect on high privilege

Steps to Reproduce

1. Create/edit module
2. Edit main.vue and add for example: alert("xss") in script block
3. Open module and browser will render this main.vue
4. Get XSS alert, or interact with WebSocket using Cross-site Websocket Hijacking bug

Place where not implemented origin check => CSWSH
Exploiting XSS we can interact with WS-server tusing valid origin, so better use CSRF-token to prevent this situations

Screenshots, screen recording, code snippet

Get XSS alert

Environment information

module version: 1.0.1

Which agent binary used?

• darwin-amd64
• linux-386
• linux-amd64
• windows-386
• windows-amd64