CVE-2020-26211: Bookstack Cross-site Scripting vulnerability
Summary
CVE-2020-26211: Bookstack Cross-site Scripting vulnerability. Affects ssddanbrown/bookstack versions < 0.30.4. Fixed in 0.30.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BookStack is an open-source platform for creating documentation and knowledge bases. It allows users to create and edit pages, organize content, and collaborate with others. The vulnerability in question allows an attacker with edit permissions to insert malicious JavaScript code or meta tags into a page. This code can be executed within the context of the current page, potentially leading to cross-site scripting attacks or unauthorized redirects. The issue affects BookStack versions prior to 0.30.4.
Vulnerability Detail
The vulnerability arises from the lack of proper input sanitization in BookStack's page editing functionality. An attacker with edit permissions can exploit this by inserting JavaScript code using javascript: URIs within links or forms. When a user clicks on the manipulated link or submits the form, the injected code will execute within the context of the page, allowing the attacker to perform malicious actions. Additionally, the attacker can insert a specific meta tag that silently redirects users to an alternative location when they visit a page. While dangerous content may be stored in the database, it is removed before being displayed on a page. However, existing exploitation of this vulnerability may still exist. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2020-26211.
How To Fix
Minimum fixed version
0.30.4
This is the first release that contains the fix.
composer require ssddanbrown/bookstack:0.30.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is to limit page edit permissions to trusted users only. By restricting the ability to edit pages, the risk of exploitation can be mitigated. However, this workaround does not address any existing exploitation that may have already occurred. It is strongly advised to upgrade to the latest version as soon as possible.
Conclusion
The BookStack Cross-site Scripting vulnerability (CVE-2020-26211) allows an attacker with edit permissions to insert malicious JavaScript code or meta tags into pages, potentially leading to cross-site scripting attacks or unauthorized redirects. Upgrading to BookStack version 0.30.4 or later is the recommended solution to fix this vulnerability. If immediate upgrade is not possible, limiting page edit permissions to trusted users can provide temporary mitigation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ssddanbrown/bookstack →
FAQ
BookStack is an open-source platform for creating documentation and knowledge bases. It provides a user-friendly interface for organizing and collaborating on content.
The vulnerability allows an attacker with edit permissions to insert malicious JavaScript code or meta tags into a page. This can lead to cross-site scripting attacks or unauthorized redirects, potentially compromising the security and integrity of the application.
You can use the Vulert Playground at Vulert Scanner to check if your BookStack installation is affected by this vulnerability. Simply provide the composer.lock file from your installation, and Vulert will analyze it for any known vulnerabilities.
Yes, the vulnerability is fixed in BookStack version 0.30.4. It is recommended to upgrade to this version or later to ensure the security of your installation.
As a temporary measure, you can limit page edit permissions to trusted users only. This will reduce the attack surface and minimize the risk of exploitation. However, it is important to note that this workaround does not address any existing exploitation that may have already occurred.
References
Related vulnerabilities
Recent vulnerabilities recorded for ssddanbrown/bookstack.
