Docs site: unescaped template/Markdown HTML (stored XSS surface)

Aperta
  • Qualcosa non va?
#4,972 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
15/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
html, javascript, jquery, markdown
Ambito
documentation, frontend, security

Direzione di ricerca

Start with web/static_content/html/tutorial_template.html around line 50, where the YouTube ID is interpolated into jQuery HTML, then check web/static_content/html/include/head.html at lines 13 and 18 for the {{$PAGE_URL}} and {{$PAGE_TITLE}} substitutions. The thread disputes whether the Markdown link path is reachable, and the template renderer lives in a submodule absent from this checkout. Done means the escaping behaviour is confirmed and the fix is agreed with maintainers, so treat this as a security triage task rather than a quick patch.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

The tutorial template interpolates a captured YouTube ID into an HTML string passed to jQuery; head/sidebar/footer templates and the Markdown pipeline emit raw HTML. A malicious page/URL can persist script content into the published site served from kframework.org.

3 finding(s) (2 MEDIUM, 1 LOW) — line-anchor verified at commit 4a46d1231473.

Findings
Severity ID Location Summary
MEDIUM web-misc-001 web/static_content/html/tutorial_template.html:50 DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template
MEDIUM web-misc-002 web/static_content/html/include/head.html:13 Unescaped template variable {{$PAGE_URL}} injected into rel=canonical href
LOW web-misc-003 web/static_content/html/include/head.html:18 Unescaped template variable {{$PAGE_TITLE}} injected into <title>
Details
web-misc-001 — DOM XSS sink: unescaped YouTube ID interpolated into jQuery HTML in tutorial template (web/static_content/html/tutorial_template.html:50)

Trigger (as reviewed): The tutorial template iterates over every anchor in .markdown-preview and, for any href matching ^https?://youtu.be/(.+?)$, takes the raw capture group youtubeId and interpolates it verbatim into an HTML string that is handed to jQuery $(...) and inserted via replaceWith. The regex anchors only the prefix and end-of-string and does not restrict the character set of the capture group, so a Markdown link target such as https://youtu.be/"> survives the match and lands inside the src="..." attribute of the generated markup.

Impact (as reviewed): The generated markup is parsed by jQuery's HTML parser and inserted into the live page. Because the attacker-controlled value is placed inside a double-quoted attribute with no attribute encoding, an injected quote plus tag/event-handler payload breaks out of the attribute and creates new elements; onerror-style handlers fire on insertion in the real kframework.org origin, giving stored XSS from merged documentation content.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=RED-TEAM-SURVIVED.

Strongest counterargument found during red-teaming: The finding's stated trigger is wrong as written: markdown-it 12.3.2 normalizeLink -> [email protected] encode percent-encodes ", < and > in every Markdown link destination, so [x](https://youtu.be/"><img src=x onerror=alert(1)>) lands in the DOM as %22%3E%3Cimg... and cannot break out of the src attribute. The sink is reachable only because k-web-theme sets html:true with no sanitizer, so the payload must arrive as an entity-encoded raw-HTML anchor (or a markdown-it-attrs {href=...} override), which makes this line a redundant second-order sink rather than the root cause; that root cause (raw HTML passed through unchecked) would allow <img onerror> injection without this template at

web-misc-002 — Unescaped template variable `{{$PAGE_URL}}` injected into `rel=canonical` href (web/static_content/html/include/head.html:13)

Trigger (as reviewed): {{$PAGE_URL}} is substituted by the k-web-theme site generator from page metadata and placed directly inside an attribute value with no HTML-attribute escaping in this template. If the page URL/metadata can be influenced by a contributor and contains a quote or angle bracket, the attribute is broken out of and arbitrary markup is injected into every generated page header.

Impact (as reviewed): Injected markup executes in the kframework.org origin for every visitor of the affected page (stored XSS) and can poison the canonical URL used by crawlers. Confirmation requires reading the k-web-theme renderer, which is a submodule absent from this checkout.

Deep review: reachability=REACHABLE-FROM-UNTRUSTED; exploitability=THEORETICAL; red-team=VERIFIABLE-UNKNOWN.

web-misc-003 — Unescaped template variable `{{$PAGE_TITLE}}` injected into `<title>` (web/static_content/html/include/head.html:18)

Trigger (as reviewed): {{$PAGE_TITLE}} is written inside <title> with no HTML escaping in the template; the value is derived from page metadata during generatePagesFromMarkdownFiles. A title containing </title><script>...</script> breaks out of the title element.

Impact (as reviewed): Persistent script execution on the published docs site in the kframework.org origin, plus a malformed document head for all visitors of the affected page. Escaping responsibility lives in k-web-theme and needs confirmation.

Deep review: reachability=REACHABLE-INTERNAL-ONLY; exploitability=EXPLOITABLE; red-team=VERIFIABLE-UNKNOWN.

Suggested fix

Escape template variables in attribute/text contexts, and sanitize (or explicitly restrict) raw HTML rendered from Markdown before publishing.

Related

Intra-repo sibling references for lines in this bundle: web-misc-003.

From a static audit of this repository at commit 4a46d1231473b599c699160132fd6e76a5c46406 (master). Every location above was verified against the source at that revision; no exploit code was run against this repository or its infrastructure.

Lingua principale
Python
Stelle
605
Fork
165
Nessuna PR unita negli ultimi 30g

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di runtimeverification/k

Tutte le issue di runtimeverification/k

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.