CVE-2012-3522: GeSHi Cross-site Scripting Vulnerability
Summary
CVE-2012-3522: GeSHi vulnerable to Cross-site Scripting. Affects geshi/geshi versions < 1.0.8.11. Fixed in 1.0.8.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeSHi (Generic Syntax Highlighter) is an open-source library used for syntax highlighting in various programming languages. It is widely utilized in web applications to enhance code readability by applying color coding to different syntax elements. However, prior to version 1.0.8.11, GeSHi was found to be vulnerable to a Cross-site Scripting (XSS) attack, which could allow attackers to inject malicious scripts into web pages viewed by users.
Vulnerability Detail
The Cross-site Scripting vulnerability in GeSHi arises from improper handling of user input in the contrib/langwiz.php file. This flaw allows remote attackers to inject arbitrary web scripts or HTML through unspecified vectors, potentially compromising user sessions, stealing sensitive information, or redirecting users to malicious sites. The vulnerability is classified under CWE-79, which pertains to improper neutralization of input during web page generation.
How To Fix
Minimum fixed version
1.0.8.11
This is the first release that contains the fix.
composer require geshi/geshi:1.0.8.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on user inputs before they are processed by GeSHi. This can help mitigate the risk of XSS attacks until the package is updated. For example, you can use PHP's htmlspecialchars function to encode special characters:
<?php ``` $input = htmlspecialchars($user_input, ENT_QUOTES, 'UTF-8'); ``` ?>Conclusion
The GeSHi library is a valuable tool for syntax highlighting, but it is crucial to address the identified Cross-site Scripting vulnerability (CVE-2012-3522) by updating to version 1.0.8.11 or later. Implementing proper input validation can also help mitigate risks until the update is applied.
See every vulnerability recorded for geshi/geshi →
FAQ
Cross-site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users, potentially compromising user data and sessions.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without any signup.
If exploited, this vulnerability can lead to unauthorized access to user sessions, data theft, and redirection to malicious websites, posing significant risks to users and applications.
Yes, you can implement input validation and sanitization on user inputs to reduce the risk of XSS attacks until you can update to the patched version.
You can find more information on the official GeSHi GitHub repository and security advisories related to the package.
Related vulnerabilities
Recent vulnerabilities recorded for geshi/geshi.
