Multiple Products 'index.js' Multiple HTML Injection Vulnerabilities

Bugtraq ID:	71824
Class:	Input Validation Error
CVE:	CVE-2015-3296 CVE-2015-3295
Remote:	Yes
Local:	No
Published:	Apr 10 2015 12:00AM
Updated:	Apr 10 2015 12:00AM
Credit:	Shubham Shah
Vulnerable:	NodeBB NodeBB 0.61 markdown-it markdown-it 4.0.3 markdown-it markdown-it 4.0.2 markdown-it markdown-it 4.0.1 markdown-it markdown-it 4.0
Not Vulnerable:	NodeBB NodeBB 0.70 markdown-it markdown-it 4.1

Multiple Products 'index.js' Multiple HTML Injection Vulnerabilities

Multiple products are prone to multiple HTML-injection vulnerabilities because they fails to properly sanitize user-supplied input.

Attacker supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.

The following products are vulnerable:

Versions prior to markdown-it 4.1.0 are vulnerable.
Versions prior to NodeBB 0.70 are vulnerable.

Multiple Products 'index.js' Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Multiple Products 'index.js' Multiple HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Products 'index.js' Multiple HTML Injection Vulnerabilities

References:

• Disabled data URIs (allow only some whitelisted images) (GitHub)
  
• markdown-it Home Page (GitHub)
  
• updated plugin to use markdown-it instead of remarkable, and updated �?� (GitHub)
  
• NodeBB Home Page (GitHub)
  
• NodeBB Persistent XSS through Markdown (Seclists.org)