¡¾Îó²îͨ¸æ¡¿Wiki.js ¿çÕ¾¾ç±¾Îó²î£¨CVE-2021-43856£©

Ðû²¼Ê±¼ä 2021-12-31

 

0x00 Îó²î¸ÅÊö

CVE     ID

CVE-2021-43856

ʱ      ¼ä

2021-12-26

Àà      ÐÍ

XSS

µÈ      ¼¶

¸ßΣ

Ô¶³ÌʹÓÃ

ÊÇ

Ó°Ïì¹æÄ£


¹¥»÷ÖØÆ¯ºó

µÍ

Óû§½»»¥

ÊÇ

PoC/EXP


ÔÚҰʹÓÃ


 

0x01 Îó²îÏêÇé

image.png

Wiki.js ÊÇÒ»¸ö»ùÓÚNode.jsµÄÇáÁ¿¼¶¿ªÔ´wikiÈí¼þ¡£¡£¡£¡£

2021Äê12ÔÂ26ÈÕ£¬£¬£¬ £¬£¬£¬£¬Wiki.jsÏîÄ¿Ðû²¼Ç徲ͨ¸æ£¬£¬£¬ £¬£¬£¬£¬ÐÞ¸´ÁËWiki.jsÖеÄ2¸öXSSÎó²î£¨CVE-2021-43856ºÍCVE-2021-43855£©£¬£¬£¬ £¬£¬£¬£¬ÆäCVSSÆÀ·Ö¾ùΪ8.2¡£¡£¡£¡£

Wiki.js XSSÎó²î£¨CVE-2021-43856£©

Wiki.js 2.5.264֮ǰµÄ°æ±¾ÈÝÒ×Êܵ½Í¨¹ý·ÇͼÏñÎļþÉÏ´«µÄ´æ´¢ÐÍ¿çÕ¾¾ç±¾µÄ¹¥»÷£¬£¬£¬ £¬£¬£¬£¬ÕâЩÎļþÀàÐÍ¿ÉÒÔÔÚä¯ÀÀÆ÷ÖÐÖ±½ÓÄÚÁªÉó²é¡£¡£¡£¡£Í¨¹ý½¨ÉèÔÚä¯ÀÀÆ÷ÖÐÉó²éʱ¿ÉÒÔÖ´ÐÐÄÚÁª JS µÄ¶ñÒâÎļþ£¨Èç XML Îļþ£©£¬£¬£¬ £¬£¬£¬£¬µ±ÆäËûÓû§Éó²é¸ÃÎļþʱ½«Ö´ÐжñÒâJavaScript£¬£¬£¬ £¬£¬£¬£¬µ«¸ÃÎļþ±ØÐèÓÉÓû§·­¿ª£¬£¬£¬ £¬£¬£¬£¬²»»áÔÚÕý³£µÄWiki.jsÒ³ÃæÖ±½Ó´¥·¢¡£¡£¡£¡£

 

Wiki.js XSSÎó²î£¨CVE-2021-43855£©

Wiki.js 2.5.264֮ǰµÄ°æ±¾ÈÝÒ×Êܵ½Í¨¹ýʹÓÃαÔìMIME ÀàÐ͵Ä×Ô½ç˵ÇëÇóÉÏ´« SVG ÎļþµÄ´æ´¢ÐÍ¿çÕ¾¾ç±¾µÄ¹¥»÷¡£¡£¡£¡£ÆäËûÓû§Ö±½ÓÉó²é SVG Îļþʱ½«Ö´ÐжñÒâ JavaScript£¬£¬£¬ £¬£¬£¬£¬µ±Í¨¹ýͨË×±êÇ©¼ÓÔØµ½Ò³ÃæÄÚʱ£¬£¬£¬ £¬£¬£¬£¬¾ç±¾²»»áÖ´ÐС£¡£¡£¡£¶ñÒâµÄSVGÎļþÖ»ÄÜͨ¹ýʹÓÃαÔìµÄMIMEÀàÐÍÏòЧÀÍÆ÷·¢ËÍ×Ô½ç˵ÇëÇóÀ´ÉÏ´«¡£¡£¡£¡£

 

Ó°Ïì¹æÄ£

Wiki.js < 2.5.264

 

0x02 ´¦Öóͷ£½¨Òé

ÏÖÔÚÕâЩÎó²îÒѾ­ÐÞ¸´£¬£¬£¬ £¬£¬£¬£¬½¨ÒéÊÜÓ°ÏìÓû§ÊµÊ±Éý¼¶¸üÐÂÖÁWiki.js 2.5.264°æ±¾¡£¡£¡£¡£

ÏÂÔØÁ´½Ó£º

https://github.com/Requarks/wiki

 

0x03 ²Î¿¼Á´½Ó

https://github.com/Requarks/wiki/security/advisories/GHSA-rhpf-929m-7fm2

https://github.com/Requarks/wiki/security/advisories/GHSA-4893-pj5w-3hq9

https://github.com/Requarks/wiki/commit/57b56d3a5b9c00358814e76f3ee5b4bb353ad62f

 

0x04 ¸üа汾

°æ±¾

ÈÕÆÚ

ÐÞ¸ÄÄÚÈÝ

V1.0

2021-12-31

Ê×´ÎÐû²¼

 

0x05 ¹ØÓÚ¼øºÚµ£±£Íø


¼øºÚµ£±£Íø¼ò½é

¼øºÚµ£±£Íø¹«Ë¾½¨ÉèÓÚ1996Ä꣬£¬£¬ £¬£¬£¬£¬²¢ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉî½»ËùÖÐС°åÕýʽ¹ÒÅÆÉÏÊУ¬£¬£¬ £¬£¬£¬£¬ÊǺ£ÄÚ¼«¾ßʵÁ¦µÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÍøÂçÇå¾²²úÆ·¡¢¿ÉÐÅÇå¾²ÖÎÀíÆ½Ì¨¡¢Ç徲ЧÀÍÓë½â¾ö¼Æ»®µÄ×ÛºÏÌṩÉÌ¡£¡£¡£¡£

¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°£¬£¬£¬ £¬£¬£¬£¬ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÓзÖÖ§»ú¹¹£¬£¬£¬ £¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÇþµÀϵͳºÍÊÖÒÕÖ§³ÖÖÐÐÄ£¬£¬£¬ £¬£¬£¬£¬²¢ÔÚ±±¾©¡¢ÉϺ£¡¢³É¶¼¡¢¹ãÖÝ¡¢³¤É³¡¢º¼ÖÝµÈ¶àµØÉèÓÐÑз¢ÖÐÐÄ¡£¡£¡£¡£

¶àÄêÀ´£¬£¬£¬ £¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬ £¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬ £¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£

 

¹ØÓÚ¼øºÚµ£±£Íø

¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÖ÷ÒªÕë¶ÔÖ÷ÒªÇå¾²Îó²îµÄÔ¤¾¯¡¢¸ú×ٺͷÖÏíÈ«Çò×îеÄÍþвÇ鱨ºÍÇå¾²±¨¸æ¡£¡£¡£¡£

¹Ø×¢ÒÔϹ«Öںţ¬£¬£¬ £¬£¬£¬£¬»ñȡȫÇò×îÐÂÇå¾²×ÊѶ£º

image.png