GHSA-r52f-r9v5-66xr: XSS
Impact CommonMark is configured with htmlinput => 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset detail page and clicks the link executes arbitrary JavaScript in their browser session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/snipe/snipe-itto a version that resolves this vulnerability.Fixed in 8.6.2 - Compensating control
Restrict use of asset markdown-textarea custom fields (and/or the `assets.edit` permission) so only trusted users can create/edit content that could contain `javascript:` links.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with the assets.edit permission and access to a markdown-textarea custom field. They can place a malicious javascript: link in that field.
Who is affected after a malicious link has been added?
Any user who opens the affected asset detail page and clicks the malicious link can have arbitrary JavaScript execute in their browser session.
Does escaping raw HTML prevent exploitation?
No. The described CommonMark html_input => 'escape' configuration blocks raw HTML injection, but it does not sanitize javascript: URIs in Markdown hyperlinks.