{"id":19480,"date":"2023-02-15T10:21:57","date_gmt":"2023-02-15T09:21:57","guid":{"rendered":"https:\/\/herolab.usd.de\/?page_id=19480"},"modified":"2023-03-17T08:25:40","modified_gmt":"2023-03-17T07:25:40","slug":"usd-2022-0032","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2022-0032\/","title":{"rendered":"usd-2022-0032"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.16\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.16\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.19.5\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" global_colors_info=\"{}\" sticky_enabled=\"0\"]<\/p>\n<h1>usd-2022-0032 | Seafile 9.0.6 - Cross-Site Scripting<\/h1>\n<p><strong>Advisory ID:<\/strong> usd-2022-0032<br \/><strong>Product:<\/strong> Seafile<br \/><strong>Affected Version:<\/strong> 9.0.6<br \/><strong>Vulnerability Type:<\/strong> <span>Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (<\/span>CWE-79)<br \/><strong>Security Risk:<\/strong> Medium<br \/><strong>Vendor URL:<\/strong> <a>https:\/\/seafile.com<\/a><br \/><strong>Vendor Status:<\/strong> fixed<br \/><strong>CVE number:<\/strong><span>\u00a0 requested<\/span><\/p>\n<p><span><\/span><\/p>\n<h2>Description<\/h2>\n<p>The Seafile application allows to set up a self-hosted cloud storage system. It supports common functions such as synchronization of files between server and client, as well as group sharing.<br \/>In addition to the basic functions, Seafile also provides it's users with a wiki and a discussion feature. The markdown editor, provided by the application, does not properly filter javscript URIs from the `href` attribute, which results in stored XSS.<\/p>\n<h2>Proof of Concept<\/h2>\n<p>The markdown editor allows an attacker to inject a javascript payload in the *href* attribute of the *a* tag.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/02\/usd20220032-proof.png\" width=\"724\" height=\"399\" alt=\"\" class=\"wp-image-19462 alignnone size-full\" srcset=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/02\/usd20220032-proof.png 724w, https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2023\/02\/usd20220032-proof-480x265.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) 724px, 100vw\" \/><\/p>\n<p>The payload is executed if a user visits and clicks on the link on the wiki page (or the file somewhere else).<\/p>\n<h2>Fix<\/h2>\n<p>It is recommended to treat all input on the website as potentially dangerous.<br \/>Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context.<br \/>The majority of programming languages support standard procedures for encoding meta characters.<\/p>\n<h2>References<\/h2>\n<ul>\n<li><a>https:\/\/owasp.org\/www-community\/attacks\/xss\/<\/a><\/li>\n<li><a href=\"https:\/\/manual.seafile.com\/changelog\/server-changelog\/#908-2022-09-07\" target=\"_blank\" rel=\"noopener\">https:\/\/manual.seafile.com\/changelog\/server-changelog\/#908-2022-09-07<\/a><\/li>\n<\/ul>\n<h2>Timeline<\/h2>\n<ul>\n<li><strong>2022-07-15:<\/strong> First contact request via <a href=\"mailto:info@seafile.com\">info@seafile.com<\/a><\/li>\n<li><strong>2022-08-02:<\/strong> Second contact request via <a href=\"mailto:info@seafile.com\">info@seafile.com<\/a><\/li>\n<li><strong>2022-08-11:<\/strong> Third contact request via info@seafile.com and <a href=\"mailto:seafile@datamate.org\">seafile@datamate.org<\/a><\/li>\n<li><strong>2022-09-02:<\/strong> Vendor reports vulnerability as fixed (usd-2022-0032). Second advisory still in triage(usd-2022-0033)<\/li>\n<li><strong>2022-10-31:<\/strong> Both advisories fixed in new release 9.0.7<\/li>\n<li><strong>2023-02-14:<\/strong> The advisory is published<\/li>\n<\/ul>\n<h2>Credits<\/h2>\n<p>This security vulnerability was found by Christian P\u00f6schl of usd AG.<\/p>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2022-0032 | Seafile 9.0.6 - Cross-Site Scripting Advisory ID: usd-2022-0032Product: SeafileAffected Version: 9.0.6Vulnerability Type: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)Security Risk: MediumVendor URL: https:\/\/seafile.comVendor Status: fixedCVE number:\u00a0 requested Description The Seafile application allows to set up a self-hosted cloud storage system. It supports common functions such as synchronization of files [&hellip;]<\/p>\n","protected":false},"author":96,"featured_media":17032,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-19480","page","type-page","status-publish","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19480","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=19480"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/19480\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media\/17032"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=19480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}