PT-2022-20533 · Mermaid+1 · Mermaid+1

Knsv · Published 2022-06-28 · Updated 2023-07-21 · CVE-2022-31108

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mermaid versions prior to 9.1.3

Description Mermaid is a JavaScript-based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker can inject arbitrary CSS into the generated graph, allowing them to change the styling of elements outside of the generated graph and potentially exfiltrate sensitive information by using specially crafted CSS selectors. This issue may lead to Information Disclosure via CSS selectors and functions able to generate HTTP requests, and also allows an attacker to change the document in ways that may lead a user to perform unintended actions.

Recommendations For versions prior to 9.1.3, ensure that user input is adequately escaped before embedding it in CSS blocks. As a temporary workaround, consider restricting the use of user-inputted CSS until a patch is available. Users are advised to upgrade to version 9.1.3 or later to resolve the issue. If upgrading is not possible, users should ensure that all user input is properly sanitized to prevent arbitrary CSS injection.

Exploit

Fix

XSS

Special Elements Injection

Weakness Enumeration

CWE-79

CWE-74

Related Identifiers

CVE-2022-31108

GHSA-X3VM-38HW-55WF

Affected Products

Debian

Mermaid

References · 13

• 🔥 https://github.com/mermaid-js/mermaid/security/advisories/GHSA-x3vm-38hw-55wf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31108.json · Exploit
• https://github.com/mermaid-js/mermaid/commit/0ae1bdb61adff1cd485caff8c62ec6b8ac57b225 · Patch
• https://cve.org/CVERecord?id=CVE-2022-31108 · Security Note
• https://ubuntu.com/security/CVE-2022-31108 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-31108 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-31108 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31108 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-31108 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31108 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3vm-38hw-55wf · Vendor Advisory
• https://github.com/mermaid-js/mermaid · Note
• https://t.me/cibsecurity/45328 · Telegram Post