GHSA-85q9-7467-r53q XSS Vulnerability in Markdown Editor
An attacker with low privileges can inject malicious scripts into markdown fields, leading to code execution in other users' browsers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-85q9-7467-r53q?
GHSA-85q9-7467-r53q is a cross-site scripting vulnerability in inventree, published on 17 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
InvenTree uses EasyMDE for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).
By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.
Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users
Solution
The solution here is two-fold:
- Enable data sanitization for the EasyMDE renderer - #3205
- Enforce cleaning of all data uploaded to the database via the API - #3204 (This will be ready for the 0.8.0 release)
Patches
- The issue is addressed in the 0.8.0 release
- This fix was back-ported to the 0.7.x branch, applied to the 0.7.3 release
Workarounds
There is no workaround for this issue without upgrading InvenTree to the specified version.
References
For more information
If you have any questions or comments about this advisory:
- Open an issue in github
- Email us at [email protected]
Which versions are affected by GHSA-85q9-7467-r53q?
2 open source packages ship an affected version, including inventree.
| Package | Affected | Fixed in |
|---|---|---|
inventree PyPI | All versions | 0.7.3 |
inventree PyPI | All versions | 0.7.3 |
How do I fix GHSA-85q9-7467-r53q?
Upgrade inventree to 0.7.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-85q9-7467-r53q being exploited?
There is no known exploitation of GHSA-85q9-7467-r53q in the wild and no public exploit code.