CVE-2020-26287
In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.
- CVSS 3.1
- 8.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
- EPSS
- 1.45% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- hedgedoc/hedgedoc
- Source
- security-advisories@github.com
References
- https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.mdExploit, Third Party Advisory
- https://github.com/hackmdio/codimd/issues/1630Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4Patch, Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95pThird Party Advisory
- https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.mdExploit, Third Party Advisory
- https://github.com/hackmdio/codimd/issues/1630Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4Patch, Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95pThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.