PT-2024-26125 · Wiki.Js · Wiki.Js

Et43 · Published 2024-05-20 · Updated 2024-06-05 · CVE-2024-34710

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Wiki.js versions prior to 2.5.303

Description A client-side template injection issue was discovered in Wiki.js, a wiki app built on Node.js. This issue could allow an attacker to inject malicious JavaScript into the content section of pages, which would execute when a victim loads the page containing the payload. The injection is possible through the use of an invalid HTML tag with a template injection payload on the next line.

Recommendations For versions prior to 2.5.303, update to version 2.5.303 to resolve the issue. As a temporary workaround, consider restricting the ability to inject custom HTML tags into the content section of pages until the update can be applied.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2024-34710

GHSA-XJCJ-P2QV-Q3RF

GO-2024-2875

Affected Products

Wiki.Js

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34710.json · Exploit
• https://osv.dev/vulnerability/GO-2024-2875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34710 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34710 · Vendor Advisory
• https://github.com/requarks/wiki/commit/1238d614e1599fefadd4614ee4b5797a087f50ac · Note
• https://github.com/requarks/wiki/security/advisories/GHSA-xjcj-p2qv-q3rf · Note
• https://t.me/pentestingnews/47336 · Telegram Post
• https://twitter.com/cracbot/status/1793522356436304116 · Twitter Post
• https://t.me/cvenotify/80496 · Telegram Post
• https://t.me/cvenotify/80541 · Telegram Post