PT-2021-11237 · Mdbook · Mdbook

Kamil Vavra · Published 2021-01-04 · Updated 2021-08-25 · CVE-2020-26297

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: mdBook versions prior to 0.4.5

Description: The search feature of mdBook is affected by a cross-site scripting vulnerability, which could allow an attacker to execute arbitrary JavaScript code on a user's browser. This can be achieved by tricking the user into typing a malicious search query or clicking a link to the search page with the malicious search query prefilled. The vulnerability was introduced in version 0.1.4 and is fixed in mdBook 0.4.5 by properly escaping the search query.

Recommendations: For mdBook versions prior to 0.4.5, upgrade to mdBook 0.4.5 or greater and rebuild website contents with it. As a temporary workaround, consider restricting access to the search feature until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-26297

GHSA-GX5W-RRHP-F436

RUSTSEC-2021-0001

Affected Products

Mdbook

References · 12

• https://github.com/rust-lang/mdBook/commit/32abeef088e98327ca0dfccdad92e84afa9d2e9b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26297 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26297 · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2021-0001 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gx5w-rrhp-f436 · Vendor Advisory
• https://github.com/rust-lang/mdBook/security/advisories/GHSA-gx5w-rrhp-f436 · Note
• https://github.com/rust-lang/mdBook/blob/master/CHANGELOG.md#mdbook-045 · Note
• https://github.com/rust-lang/mdBook · Note
• https://rustsec.org/advisories/RUSTSEC-2021-0001.html · Note
• https://crates.io/crates/mdbook · Note
• https://t.me/cibsecurity/21556 · Telegram Post
• https://groups.google.com/g/rustlang-security-announcements/c/3-sO6of29O0 · Note