HSEC-2023-0008

See a problem?
Import Source
https://github.com/haskell/security-advisories/blob/generated/osv-export/2023/HSEC-2023-0008.json
JSON Data
https://api.osv.dev/v1/vulns/HSEC-2023-0008
Aliases
Published
2023-07-22T12:23:10Z
Modified
2023-12-13T13:05:27.423842Z
Summary
Stored XSS in hledger-web
Details

Stored XSS in hledger-web

An issue was discovered in hledger-web < 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

hledger-web forms sanitise obvious JavaScript, but not obfuscated JavaScript (see OWASP Filter Evasion Cheat Sheet). This means hledger-web instances, especially anonymously-writable ones like demo.hledger.org, could be loaded with malicious JavaScript to be executed by subsequent visitors.

Reported by Gaspard Baye and Hamidullah Muslih. Fix by Arsen Arsenović.

References

Affected packages

Hackage / hledger-web

Package

Name
hledger-web
Purl
pkg:hackage/hledger-web

Severity

  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0.24
Fixed
1.23

Affected versions

0.*

0.24
0.24.1
0.25
0.25.1
0.26
0.27

1.*

1.0
1.0.1
1.1
1.2
1.3
1.3.1
1.3.2
1.4
1.5
1.5.1
1.9
1.9.1
1.9.2
1.10
1.11
1.11.1
1.12
1.13
1.14
1.14.1
1.15
1.16
1.16.1
1.16.2
1.17
1.17.1
1.18
1.18.1
1.19
1.19.1
1.20
1.20.1
1.20.2
1.20.3
1.20.4
1.21
1.22
1.22.1
1.22.2