PT-2021-15446 · Docsify · Docsify

Egidio Romano + 2 · Published 2021-02-19 · Updated 2021-03-01 · CVE-2021-23342

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions docsify versions prior to 4.12.0

Description The issue allows for the bypass of previous remediation efforts, enabling the execution of malicious JavaScript through two methods. Firstly, when parsing HTML from remote URLs, the main page's HTML code is sanitized, but this sanitization does not occur in the sidebar. Secondly, the isURL external check can be bypassed by inserting additional //// characters.

Recommendations For versions prior to 4.12.0, update to version 4.12.0 or later to resolve the issue. As a temporary workaround, consider disabling the parsing of HTML from remote URLs or restricting the use of the sidebar until a patch is available. Avoid using the isURL external check with URLs containing multiple //// characters until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-23342

GHSA-2MM9-C2FX-C7M4

SNYK-JAVA-ORGWEBJARSNPM-1076593

SNYK-JS-DOCSIFY-1066017

Affected Products

Docsify

References · 10

• 🔥 http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-DOCSIFY-1066017 · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076593 · Exploit
• https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe · Patch
• https://osv.dev/vulnerability/CVE-2021-23342 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2mm9-c2fx-c7m4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23342 · Security Note
• https://npmjs.com/package/docsify · Note
• https://t.me/cibsecurity/23878 · Telegram Post
• http://seclists.org/fulldisclosure/2021/Feb/71 · Note