PT-2021-14463 · Wiki.Js · Wiki.Js

Mina M. Edwar · Published 2021-03-18 · Updated 2021-03-24 · CVE-2021-21383

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Wiki.js versions prior to 2.5.191

Description The issue exists due to mustache expressions being parsed by Vue during content injection, even when contained within a <pre> element. This allows a malicious user to stage a stored cross-site scripting attack by creating a crafted wiki page. The attacker can execute malicious JavaScript when the page is viewed by other users.

Recommendations For versions prior to 2.5.191, update to version 2.5.191 or later, which includes the fix by adding the v-pre directive to all <pre> tags during the render. As a temporary workaround, consider restricting access to the <pre> element or disabling the mustache expressions in code blocks until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21383

GHSA-6XX4-M8GX-826R

Affected Products

Wiki.Js

References · 6

• 🔥 https://github.com/Requarks/wiki/security/advisories/GHSA-6xx4-m8gx-826r · Exploit
• https://github.com/Requarks/wiki/commit/5ffa189383dd716f12b56b8cae2ba0d075996cf1 · Patch
• https://osv.dev/vulnerability/CVE-2021-21383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21383 · Security Note
• https://github.com/Requarks/wiki/releases/tag/2.5.191 · Note
• https://t.me/cibsecurity/25126 · Telegram Post