Vulnerability Description
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but `www.google-analytics.com` is allowed. Using Google Tag Manger it is possible to inject arbitrary JavaScript and execute it on page load. Depending on the configuration of the instance, the attacker may not need authentication to create or edit notes. The problem is patched in HedgeDoc 1.7.1. As a workaround one can disallow `www.google-analytics.com` in the `Content-Security-Policy` header. Note that other ways to leverage the `script` tag injection might exist.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hedgedoc | Hedgedoc | < 1.7.1 |
Related Weaknesses (CWE)
References
- https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.mdExploitThird Party Advisory
- https://github.com/hackmdio/codimd/issues/1630Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc10PatchThird Party Advisory
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95pThird Party Advisory
- https://github.com/Alemmi/ctf-writeups/blob/main/hxpctf-2020/hackme/solution.mdExploitThird Party Advisory
- https://github.com/hackmdio/codimd/issues/1630Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/commit/58276ebbf4504a682454a3686dcaff88bc10PatchThird Party Advisory
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95pThird Party Advisory
FAQ
What is CVE-2020-26287?
CVE-2020-26287 is a vulnerability with a CVSS score of 8.7 (HIGH). HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Our con...
How severe is CVE-2020-26287?
CVE-2020-26287 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-26287?
Check the references section above for vendor advisories and patch information. Affected products include: Hedgedoc Hedgedoc.