PT-2021-22433 · Hedgedoc · Hedgedoc

Davidmehren · Published 2021-08-30 · Updated 2022-10-25 · CVE-2021-39175

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.9.0

Description HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript into the speaker-notes of the slide-mode feature by embedding an iframe hosting the malicious code into the slides or by embedding the HedgeDoc instance into another page.

Recommendations For versions prior to 1.9.0, upgrade to version 1.9.0 to resolve the issue. As a temporary workaround, consider restricting the use of the slide-mode feature until the upgrade is applied. Additionally, avoid embedding the HedgeDoc instance into other pages or embedding iframes hosting malicious code into the slides until the issue is resolved.

Fix

Special Elements Injection

XSS

Origin Validation Error

Weakness Enumeration

CWE-74

CWE-79

CWE-346

Related Identifiers

CVE-2021-39175

GHSA-J748-779H-9697

Affected Products

Hedgedoc

References · 8

• https://github.com/hedgedoc/hedgedoc/pull/1513 · Patch
• https://github.com/hedgedoc/hedgedoc/pull/1369 · Patch
• https://github.com/hedgedoc/hedgedoc/pull/1375 · Patch
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-j748-779h-9697 · Patch
• https://osv.dev/vulnerability/CVE-2021-39175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39175 · Security Note
• https://t.me/cvenotify/20402 · Telegram Post
• https://t.me/cibsecurity/28046 · Telegram Post