CVE-2021-23342

This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html	Exploit Third Party Advisory
http://seclists.org/fulldisclosure/2021/Feb/71	Mailing List Third Party Advisory
https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe	Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076593	Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JS-DOCSIFY-1066017	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:docsifyjs:docsify:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-02-19 17:15

Updated : 2024-02-28 18:08

NVD link : CVE-2021-23342

Mitre link : CVE-2021-23342

CVE.ORG link : CVE-2021-23342

JSON object : View

Products Affected

docsifyjs

docsify

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-23342", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2021-02-19T17:15:13.717", "references": [{"url": "http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "http://seclists.org/fulldisclosure/2021/Feb/71", "tags": ["Mailing List", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe", "tags": ["Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076593", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JS-DOCSIFY-1066017", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more \u201c////\u201d characters"}, {"lang": "es", "value": "Esto afecta al paquete docsify versiones anteriores a 4.12.0. Es posible omitir la correcci\u00f3n realizada por CVE-2020-7680 y ejecutar JavaScript malicioso por medio de los siguientes m\u00e9todos 1) Al analizar HTML desde URL remotas, el c\u00f3digo HTML en la p\u00e1gina principal es saneado, pero este saneamiento no se lleva a cabo en el barra lateral. 2) La comprobaci\u00f3n externa de isURL se puede omitir insertando m\u00e1s caracteres \"////\""}], "lastModified": "2021-02-25T22:22:18.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:docsifyjs:docsify:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E69E149B-25FD-4819-B489-EC99DA188A8E", "versionEndExcluding": "4.12.0"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}