Vulnerability-Lookup

GHSA-Q6XV-JM4V-349H

Vulnerability from github – Published: 2024-06-26 19:03 – Updated: 2024-06-26 21:56

Summary

Cross-site Scripting in ZenUML

Details

Summary

Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS).

Details

The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as ** for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS.

https://github.com/mermaid-js/zenuml-core/blob/dcfee8cde42673c09e19401f43ad8506658c8442/src/components/DiagramFrame/SeqDiagram/MessageLayer/Block/Statement/Comment/Comment.vue#L65

PoC

// p<img onerror=alert(1) src=""/>
A->B:hi

Above is a POC diagram payload that results in an XSS.

Here is a similar POC in mermaid.live: https://mermaid.live/edit#pako:eNpNjrFuwyAQhl8F3dRK1DaQGhs1kVq1Y6duFQsylwTVgEWw1MTyuxc5S7df39399y0wRIug4IZh9qMOdU2mF-dPJAZMKaa9GTHlB_ZILmnYa9BQH3R4fTq8qbMDCh6TN86WhkUHQjTkM3rUoEq0Jv2Ui7CWPTPn-HUNA6icZqQwT9ZkfHfmlIwHdTTjpVC0Lsf0eVfazChMJoBa4BdUL6uGC8n7TrCGd5zCFRRnXbVjvBVNK3gJXbtSuMVYSlnFC-Kyf961UshWbmXf2-y_xcf29c7WP2yrVC0

Impact

This puts existing applications that use ZenUML unsandboxed at risk of arbitrary JavaScript execution when rendering user-controlled diagrams.

Severity ?

5.4 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@zenuml/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.23.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-38527"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-80"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-26T19:03:54Z",
    "nvd_published_at": "2024-06-26T20:15:16Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nMarkdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS).\n\n### Details\n\nThe comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as `**` for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS.\n\nhttps://github.com/mermaid-js/zenuml-core/blob/dcfee8cde42673c09e19401f43ad8506658c8442/src/components/DiagramFrame/SeqDiagram/MessageLayer/Block/Statement/Comment/Comment.vue#L65\n\n### PoC\n\n```\n// p\u003cimg onerror=alert(1) src=\"\"/\u003e\nA-\u003eB:hi\n```\n\nAbove is a POC diagram payload that results in an XSS.\n\nHere is a similar POC in mermaid.live: https://mermaid.live/edit#pako:eNpNjrFuwyAQhl8F3dRK1DaQGhs1kVq1Y6duFQsylwTVgEWw1MTyuxc5S7df39399y0wRIug4IZh9qMOdU2mF-dPJAZMKaa9GTHlB_ZILmnYa9BQH3R4fTq8qbMDCh6TN86WhkUHQjTkM3rUoEq0Jv2Ui7CWPTPn-HUNA6icZqQwT9ZkfHfmlIwHdTTjpVC0Lsf0eVfazChMJoBa4BdUL6uGC8n7TrCGd5zCFRRnXbVjvBVNK3gJXbtSuMVYSlnFC-Kyf961UshWbmXf2-y_xcf29c7WP2yrVC0\n\n### Impact\n\nThis puts existing applications that use ZenUML **unsandboxed** at risk of arbitrary JavaScript execution when rendering user-controlled diagrams.",
  "id": "GHSA-q6xv-jm4v-349h",
  "modified": "2024-06-26T21:56:14Z",
  "published": "2024-06-26T19:03:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mermaid-js/zenuml-core/security/advisories/GHSA-q6xv-jm4v-349h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38527"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mermaid-js/zenuml-core/commit/ad7545b33f5f27466cbf357beb65969ca1953e3c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mermaid-js/zenuml-core"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Cross-site Scripting in ZenUML"
}

CVE-2024-38527 (GCVE-0-2024-38527)

Vulnerability from cvelistv5 – Published: 2024-06-26 19:33 – Updated: 2024-08-02 04:12

Title

Cross-site Scripting in ZenUML

Summary

ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as `**` for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS. This puts existing applications that use ZenUML unsandboxed at risk of arbitrary JavaScript execution when rendering user-controlled diagrams. This vulnerability was patched in version 3.23.25,

Severity ?

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/mermaid-js/zenuml-core/securit…	x_refsource_CONFIRM
	https://github.com/mermaid-js/zenuml-core/commit/…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	mermaid-js	zenuml-core	Affected: < 3.23.25

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:mermaidjs:zenuml-core:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "zenuml-core",
            "vendor": "mermaidjs",
            "versions": [
              {
                "lessThanOrEqual": "3.0.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38527",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-27T19:02:31.612648Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-27T19:04:37.531Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.179Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mermaid-js/zenuml-core/security/advisories/GHSA-q6xv-jm4v-349h",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mermaid-js/zenuml-core/security/advisories/GHSA-q6xv-jm4v-349h"
          },
          {
            "name": "https://github.com/mermaid-js/zenuml-core/commit/ad7545b33f5f27466cbf357beb65969ca1953e3c",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mermaid-js/zenuml-core/commit/ad7545b33f5f27466cbf357beb65969ca1953e3c"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "zenuml-core",
          "vendor": "mermaid-js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.23.25"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and modify sequence diagrams. Markdown-based comments in the ZenUML diagram syntax are susceptible to Cross-site Scripting (XSS). The comment feature allows the user to attach small notes for reference. This feature allows the user to enter in their comment in markdown comment, allowing them to use common markdown features, such as `**` for bolded text. However, the markdown text is currently not sanitized before rendering, allowing an attacker to enter a malicious payload for the comment which leads to XSS. This puts existing applications that use ZenUML unsandboxed at risk of arbitrary JavaScript execution when rendering user-controlled diagrams. This vulnerability was patched in version 3.23.25,"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-26T19:33:46.575Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mermaid-js/zenuml-core/security/advisories/GHSA-q6xv-jm4v-349h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mermaid-js/zenuml-core/security/advisories/GHSA-q6xv-jm4v-349h"
        },
        {
          "name": "https://github.com/mermaid-js/zenuml-core/commit/ad7545b33f5f27466cbf357beb65969ca1953e3c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mermaid-js/zenuml-core/commit/ad7545b33f5f27466cbf357beb65969ca1953e3c"
        }
      ],
      "source": {
        "advisory": "GHSA-q6xv-jm4v-349h",
        "discovery": "UNKNOWN"
      },
      "title": "Cross-site Scripting in ZenUML"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-38527",
    "datePublished": "2024-06-26T19:33:46.575Z",
    "dateReserved": "2024-06-18T16:37:02.728Z",
    "dateUpdated": "2024-08-02T04:12:25.179Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-Q6XV-JM4V-349H

Summary

Details

PoC

Impact

CVE-2024-38527 (GCVE-0-2024-38527)

Tags

Sightings

Nomenclature