GHSA-98pf-gfh3-x3mp Read the Docs vulnerable to Cross-Site Scripting (XSS)
A malicious user can execute arbitrary JavaScript in a victim's browser via a crafted URL, potentially hijacking their session on the documentation platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-98pf-gfh3-x3mp?
GHSA-98pf-gfh3-x3mp is a cross-site scripting vulnerability in readthedocs, published on 10 Nov 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Impact
This vulnerability allowed a malicious user to serve arbitrary HTML files from the main application domain (readthedocs[.]org/readthedocs[.]com) by exploiting a vulnerability in the code that serves downloadable content from a project.
Exploiting this would have required the attacker to get a logged-in user to visit the malicious URL, which would have allowed the attacker to take control of the user's session with JavaScript (making requests to the API/site on behalf of the user). This URL would have looked something like hxxps[:]//readthedocs[.]org/projects/attacker-project/downloads/html/version-with-javascript-attack/.
Patches
This issue has been patched in our 8.8.1 release.
Which versions are affected by GHSA-98pf-gfh3-x3mp?
2 open source packages ship an affected version, including readthedocs.
| Package | Affected | Fixed in |
|---|---|---|
readthedocs npm | All versions | 8.8.1 |
readthedocs npm | All versions | 8.8.1 |
How do I fix GHSA-98pf-gfh3-x3mp?
Upgrade readthedocs to 8.8.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-98pf-gfh3-x3mp being exploited?
There is no known exploitation of GHSA-98pf-gfh3-x3mp in the wild and no public exploit code.