PT-2020-12516 · Bookstack · Bookstack

Kenichi Okuno · Published 2020-05-07 · Updated 2020-05-13 · CVE-2020-11055

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BookStack versions 0.18.0 through 0.29.1

Description The issue allows a user with permission to create comments to inject custom JavaScript code, which could be executed on other users' machines. This is particularly impactful in scenarios where untrusted users have comment creation permissions. The vulnerability arises from the ability to POST HTML directly to the system, which is then saved and displayed to other users.

Recommendations For BookStack versions 0.18.0 through 0.29.1, update to version 0.29.2 to address the issue. After upgrading, run the command php artisan bookstack:regenerate-comment-content to remove any pre-existing dangerous content. As a temporary workaround, consider disabling comments in the system settings or altering comment creation permissions to only trusted users. However, note that altering permissions will not address existing exploitation of this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-11055

GHSA-5VF7-Q87H-PG6W

Affected Products

Bookstack

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-11055 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11055 · Vendor Advisory
• https://bookstackapp.com/blog/beta-release-v0-29-2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5vf7-q87h-pg6w · Vendor Advisory
• https://github.com/BookStackApp/BookStack/security/advisories/GHSA-5vf7-q87h-pg6w · Note
• https://github.com/BookStackApp/BookStack/releases/tag/v0.29.2 · Note
• http://jvn.jp/en/jp/JVN41035278/index.html · Note