CVE-2020-11055 Cross-site Scripting in BookStack

Medium 6.3 Published 7 May 2020 Updated 4 Aug 2024

An attacker with comment permissions can inject malicious JavaScript into BookStack comments, executing code on other users' browsers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-11055?

CVE-2020-11055 is a medium-severity cross-site scripting vulnerability in BookStackApp BookStack, published on 7 May 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.

Weakness: CWE-79

Which versions are affected by CVE-2020-11055?

2 open source packages ship an affected version, including ssddanbrown/bookstack. It affects 1 product.

Package	Affected	Fixed in
`ssddanbrown/bookstack` Packagist	From `0.18.0`	`0.29.2`
`ssddanbrown/bookstack` Packagist	From `0.18.0`	`0.29.2`

Products include Bookstackapp Bookstack.

How do I fix CVE-2020-11055?

Upgrade ssddanbrown/bookstack to 0.29.2 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-11055 being exploited?

There is no known exploitation of CVE-2020-11055 in the wild and no public exploit code.

Sources

Also known as GHSA-5vf7-q87h-pg6w.