Summary
The package @umbraco/Umbraco-CMS contains a stored XSS vulnerability in the Content page through the Markdown Editor’s preview pane. The vulnerability allows an attacker with Editor permissions to inject arbitrary JavaScript into the markdown content. When an administrator previews or publishes this page, the XSS is triggered, potentially compromising the web application. This can lead to privilege escalation and full compromise of the application. The issue was fixed by introducing HTML sanitization in the preview pane.
Product
This vulnerability affects @umbraco/Umbraco-CMS versions prior to 8.18.13, 10.8.4, 12.3.7 and 13.1.1.
Impact
This vulnerability can lead to the execution of arbitrary JavaScript in the administrator’s browser. A malicious editor can submit a page for review containing injected JavaScript, which when viewed by an administrator, can trigger XSS and result in a full application compromise.
Steps to reproduce
- Log in as an Editor and navigate to a Content page with a markdown editor and preview pane enabled.
- Inject arbitrary JavaScript into the markdown content.
- Submit the page for review.
- Log in as an Administrator and preview the page via the following URL:
/umbraco/#/content/content/edit/<id>. - The XSS is triggered.
Expected result:
The XSS is triggered, and the malicious JavaScript is executed in the administrator’s browser.
Remediation
The issue was fixed by sanitizing HTML content before rendering it in the preview pane of the markdown editor. This prevents stored XSS from being triggered in the administrator’s session.
The fix was applied in the following versions:
- 8.18.13
- 10.8.4
- 12.3.7
- 13.1.1
Credit
This issue was discovered and reported by Checkmarx Security Researcher Raphael Silva.
