CVE-2020-26287 Stored XSS in mermaid diagrams
Attackers can inject arbitrary JavaScript via mermaid diagrams in HedgeDoc notes, potentially executing code or taking over accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-26287?
CVE-2020-26287 is a high-severity cross-site scripting vulnerability in hedgedoc, published on 28 Dec 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.
Weakness: CWE-79
Which versions are affected by CVE-2020-26287?
It affects 1 product.
Products include Hedgedoc Hedgedoc.
How do I fix CVE-2020-26287?
No fix has been published for CVE-2020-26287 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-26287 being exploited?
There is no known exploitation of CVE-2020-26287 in the wild and no public exploit code.
Other vulnerabilities in hedgedoc
Sources
Also known as GHSA-g6w6-7xf9-m95p.