CVE-2021-3271 Pressbooks Stored Cross Site Scripting Proof of Concept

A Pressbooks stored cross site scripting vulnerability was discovered in all version ≤ 5.17.3. The application is vulnerable to Stored Cross-Site Scripting (XSS) injections via description body. An attacker can thus trick a user into clicking on a malicious link or preview the document that contains the JavaScript code. Once triggered, the malicious JavaScript code is fed in the victim’s browser and executed.

Pressbooks is an open-source book content management system that exports in multiple formats: ebooks, webbooks, print-ready PDF, and various XML flavours. The system is built on top of WordPress Multisite.

A Pressbooks stored cross site scripting vulnerability was discovered in all version ≤ 5.17.3. The application is vulnerable to Stored Cross-Site Scripting (XSS) injections via description body. An attacker can thus trick a user into clicking on a malicious link or preview the document that contains the JavaScript code. Once triggered, the malicious JavaScript code is fed in the victim’s browser and executed.

Pressbooks is an open-source book content management system that exports in multiple formats: ebooks, webbooks, print-ready PDF, and various XML flavours. The system is built on top of WordPress Multisite.

To exploit the vulnerability, an attacker needs to create an account, which will create a book in which they will edit the description body of the book info with their malicious code. Only basic JavaScript coding knowledge is required to perform such attacks. A successful attack can lead the attacker to obtain the victim’s session cookie. A valid attack scenario would be to clone the applications login page within the malicious HTML file. Once opened or previewed it would alert the end user that their session has expired promoting them to enter their credentials. This could lead to account takeover.

The steps to reproduce this XSS are to go to the « book info » page and then under the « long description » insert the following code:

Inject the following code into the « Long Description »:

<html>
<body>
<img src=# onerror=alert(document.cookie)>
</body>
</html>

Then the book information is saved.

The XSS will trigger every time a user visits the published pressbook book.

Impact

Stored cross site scripting.

A valid attack scenario would be to clone the applications login page, store it within the malicious HTML file. Once opened it would alert the end user that their session has expired promoting them to enter their credentials. This could lead to account takeover.

Technical Analysis

Entries entered by users should by systematically validated before processing and storage. Pressbooks should not allow HTML entities to be reflected onto the page. The use of character allow lists via strict regular expression on entries is the most effective means of mitigation against this type of attack. In addition, it is highly recommended to systematically encode user or database data into an inert format for Web browsers before sending them back to the user. The lack thereof of such implementation lead to stored cross site scripting.

Vendor Response

The Pressbooks development team sanitizes metadata book info metaboxes to prevent XSS attacks on fields that allows HTML input, this uses Htmlawed to filter and sanitize the input values. The security flaw in the pressbooks application was resolved with a pull-request merged into the dev branch of the main Pressbooks repository which addresses this vulnerability. A stable version of Pressbooks was released in late January of 2021 which includes this fix.

Timeline

Disclosed to the vendor January 1st, 2021
Acknowledged and fix was published to the dev branch on January 13th, 2021
Retests confirmed fix of vulnerability January 13th, 2021
CVE assigned January 22nd, 2021

Conclusion

Unsanitized user-input continues to be a concern in Web applications even after years of developer awareness. Although a textbook XSS, we believe publishing proof of concept for vulnerabilities like this is important as an incentive for organizations to patch.

Assigned CVE-2021-3271

Clients of GoSecure Managed Detection and Response (MDR) with the Network Detection and Response component have detection capabilities in-place in case of exploitation of this vulnerability.

CVE-2021-3271 Pressbooks Stored Cross Site Scripting Proof of Concept

Impact

Technical Analysis

Vendor Response

Timeline

Conclusion

Search

Categories

Recent Posts

Ce que nous faisons

Compagnie

SIÈGE SOCIAL MONDIAL

Rejoignez plus de 200 000 leaders de la sécurité

Inscrivez-vous à nos communications pour recevoir les dernières nouvelles, nos événements, des ressources utiles et en apprendre plus.

Adresse courriel

Cyberrisques

Sociétés de financement par capitaux propres

Sécurité des données sensibles

Conformité en matière de cybersécurité

Cyberassurance

Rançongiciels

Attaques de type « zero-day »

Consolider, évoluer et prospérer

Notre SOC

Défense proactive, 24h/24, 7j/7

GoSecure Appoints Eric Rochette to Chief Technology Officer (CTO)

Large-Scale Spear-Phishing Campaign with Malicious RDP Attachments

From Mainstream to Malicious: How Popular Smartphone Brands Are Used in Cyber Attacks on RDP

Large-Scale Spear-Phishing Campaign with Malicious RDP Attachments

Obtenez une démo

Créez une soumission

Devenez partenaire