CVE-2023-25572 React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`
Attackers can execute arbitrary scripts in browsers via unsanitized HTML in react-admin RichTextField components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-25572?
CVE-2023-25572 is a medium-severity cross-site scripting vulnerability in marmelab react-admin, published on 13 Feb 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `<RichTextField>` are affected. `<RichTextField>` outputs the field value using `dangerouslySetInnerHTML` without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use `DOMPurify` to escape the HTML before outputting it with React and `dangerouslySetInnerHTML`. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the `<RichTextField>` by a custom field doing sanitization by hand.
Weakness: CWE-79
Which versions are affected by CVE-2023-25572?
8 open source packages ship an affected version, including react-admin and ra-ui-materialui. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
react-admin npm | All versions | 3.19.12 |
react-admin npm | All versions | 3.19.12 |
react-admin npm | From 4.0.0 | 4.7.6 |
react-admin npm | From 4.0.0 | 4.7.6 |
ra-ui-materialui npm | All versions | 3.19.12 |
ra-ui-materialui npm | All versions | 3.19.12 |
2 more packages
ra-ui-materialui npm | From 4.0.0 | 4.7.6 |
ra-ui-materialui npm | From 4.0.0 | 4.7.6 |
Products include Marmelab Ra-Ui-Materialui, Marmelab React-Admin.
How do I fix CVE-2023-25572?
Upgrade react-admin to a fixed version for your release line: 3.19.12 or 4.7.6.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-25572 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-25572 exists.
Sources
Also known as GHSA-5jcr-82fh-339v.