PT-2018-4711 · Marked · Marked

Matt- + 1 · Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10531

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions marked versions 0.3.5 and earlier

Description The issue arises from the way marked parses input, specifically HTML entities, allowing for the bypass of content injection protection when sanitize: true is configured. This enables the injection of a javascript: URL. The flaw occurs because &#xNNanything; gets parsed, leaving behind any remaining characters, such as anything;. This can lead to cross-site scripting vulnerabilities in link components. For instance, a link URI like javascript&#x58document;alert(1) can render a valid link that executes alert(1) when clicked.

Recommendations Update to version 0.3.6 or later. As a temporary workaround, consider disabling the sanitize: true configuration until a patch is available. Restrict access to link components to minimize the risk of exploitation. Avoid using HTML entities in link URIs until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-10531

GHSA-VFVF-MQQ8-RWQC

Affected Products

Marked

References · 14

• 🔥 https://github.com/chjj/marked/pull/592 · Exploit
• https://github.com/chjj/marked/pull/592/commits/2cff85979be8e7a026a9aca35542c470cf5da523 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-10531 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-10531 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10531 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10531 · Security Note
• https://ubuntu.com/security/CVE-2016-10531 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vfvf-mqq8-rwqc · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-10531 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10531 · Vendor Advisory
• https://nodesecurity.io/advisories/101 · Note
• https://github.com/advisories/GHSA-vfvf-mqq8-rwqc · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10531 · Note
• https://npmjs.com/advisories/101 · Note