PT-2022-13494 · Bookstack · Bookstack

Published 2022-03-08 · Updated 2022-03-11 · CVE-2022-0877

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions bookstack versions prior to 22.02.3

Description The issue is related to Cross-site Scripting (XSS) - Stored, where an attacker can execute malicious javascript via an iframe and perform phishing attacks. This is due to the lack of a sandbox attribute in iframe tags, which allows script execution and navigation of the top-level browsing context. The sandbox attribute would block script execution and prevent such attacks.

Recommendations For versions prior to 22.02.3, update to version 22.02.3 or later to resolve the issue. As a temporary workaround, consider adding a sandbox attribute to iframe tags to block script execution and prevent navigation of the top-level browsing context. Restrict access to iframes from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-0877

GHSA-5RCC-6CMJ-7728

Affected Products

Bookstack

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0877.json · Exploit
• 🔥 https://huntr.dev/bounties/b04df4e3-ae5a-4dc6-81ec-496248b15f3c · Exploit
• https://github.com/bookstackapp/bookstack/commit/856fca8289b7370cafa033ea21c408e7d4303fd6 · Patch
• https://osv.dev/vulnerability/GHSA-5rcc-6cmj-7728 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-0877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0877 · Security Note
• https://github.com/bookstackapp/bookstack · Note
• https://t.me/cvenotify/27868 · Telegram Post
• https://t.me/cvenotify/27919 · Telegram Post
• https://t.me/cibsecurity/38534 · Telegram Post