CVE-2024-32472

excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS. This vulnerability is fixed in 0.17.6 and 0.16.4.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d
https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0
https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f

Configurations

No configuration.

History

No history.

Information

Published : 2024-04-17 22:15

Updated : 2024-04-18 13:04

NVD link : CVE-2024-32472

Mitre link : CVE-2024-32472

CVE.ORG link : CVE-2024-32472

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2024-32472", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-04-17T22:15:08.557", "references": [{"url": "https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d", "source": "security-advisories@github.com"}, {"url": "https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0", "source": "security-advisories@github.com"}, {"url": "https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS. This vulnerability is fixed in 0.17.6 and 0.16.4."}, {"lang": "es", "value": "excalidraw es una pizarra virtual de c\u00f3digo abierto dibujada a mano. Una vulnerabilidad XSS almacenada en el componente web integrable de Excalidraw. Esto permite ejecutar JavaScript arbitrario en el contexto del dominio donde est\u00e1 alojado el editor. Hab\u00eda dos vectores. Uno que representa una cadena que no es de confianza como `srcdoc` de iframe sin desinfectar adecuadamente contra la inyecci\u00f3n de HTML. En segundo lugar, mediante una desinfecci\u00f3n inadecuada contra la inyecci\u00f3n de atributos HTML. Esto, junto con permitir el indicador de zona de pruebas \"permitir el mismo origen\" (necesario para varias incrustaciones), dio como resultado el XSS. Esta vulnerabilidad se solucion\u00f3 en 0.17.6 y 0.16.4."}], "lastModified": "2024-04-18T13:04:28.900", "sourceIdentifier": "security-advisories@github.com"}