CVE Vulnerability

CVE-2020-26287

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

8.7 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 Third Party Advisory
https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p Third Party Advisory
https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.md Exploit Third Party Advisory
https://github.com/hackmdio/codimd/issues/1630 Third Party Advisory
https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc1069d4 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:hedgedoc:hedgedoc:*:*:*:*:*:*:*:*
Information

Published : 2020-12-29 12:15

Updated : 2020-12-30 04:50

NVD link : CVE-2020-26287

Mitre link : CVE-2020-26287

Products Affected
No products.
CWE
CWE-79