lakeFS Stored XSS via Raw HTML in Markdown Preview (GHSA-c2r5-9j4w-2zff) with POC

Vulnerability Overview Vulnerability Name: Stored XSS in rendered Markdown preview via raw HTML Vulnerability ID: GHSA-c2r5-9j4w-2zff Publication Date: May 22, 2023 Severity: High (CVSS v3 Base Score: 8.7/10) Scope of Impact Affected Versions: - : <=1.81.0 - : <=1.83.0 Patch Versions: - : 1.81.1 - : 1.84.0 Vulnerability Details Vulnerability Path: Description: The renderer allows embedding raw HTML in Markdown without sanitizing it, causing user-supplied HTML to reach the DOM verification stage. Trigger Conditions: The exploit payload does not always require the victim to directly open a malicious file. The Web UI automatically renders , so any user browsing to a directory containing that file is exposed. Other Markdown files are rendered only when explicitly opened by the victim. Impact: Due to scope limitations on lakeFS authentication cookies and tokens being restricted to the Web UI source, the executed payload can list and read any repositories accessible to the victim, create or delete branches and objects, send data to attacker-controlled endpoints, and invoke any other lakeFS API. Proof of Concept (POC) 1. As a user with repository write permissions, commit the following test files to any branch: 2. Send another user a link to the rendered view of one of these files. The first file navigates them to example.org upon loading via the meta refresh. The second file displays cookies or logs user information when the link is clicked. Remediation lakefs: Fixed in v1.81.1 lakefs-enterprise: Fixed in v1.84.0 Temporary Workaround Enterprise Customers: Can temporarily disable Markdown rendering using the following configuration: OSS Version: There is no temporary workaround; upgrading to the latest version is recommended.

Goal Reached Thanks to every supporter — we hit 100%!

lakeFS Stored XSS via Raw HTML in Markdown Preview (GHSA-c2r5-9j4w-2zff) with POC

More from this source