Stored XSS on oslo.io in notifications via project name change

How it was found

Hey Logitech team.

Summary:

It is possible for an editor on a project to rename a project to a malicious HTML element, which when opened in the notification dropdown will render and fire javascript.

Steps To Reproduce:

[add details for how we can reproduce the issue]

1. Invite user to join the project and allow editor permissions.
2. As the editor account, click on any of the projects and click rename. Insert malicious HTML there.
3. Log in as the owner of the project directory and click on the notification bell on the top right. This will cause the XSS to fire.

Supporting Material/References:

[list any additional material (e.g. screenshots, logs, etc.)]

Fig 1: Inviting the editor to project {F1143360}

Fig 2: Notification Settings for Owner: {F1143367}

Fig 3: Editor Changing Project name to malicious object {F1143363} {F1143364}

Fig 4: Logging in as the owner again {F1143361}

Fig 5: Opening Notification Bell {F1143362}

Impact

The impact of this vulnerability is that users who are invited onto projects as an editor are able to inject malicious javascript such as keyloggers to escalate their privileges or perform actions as other users.