HSEC-2023-0008: Stored XSS in hledger-web

Author: frasertweedale

advisories/hackage/hledger-web/HSEC-2023-0008.md

@@ -0,0 +1,47 @@
+```toml
+[advisory]
+id = "HSEC-2023-0008"
+cwe = [87]
+keywords = ["web", "xss"]
+aliases = ["CVE-2021-46888"]
+
+[[affected]]
+package = "hledger-web"
+cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
+[[affected.versions]]
+introduced = "0.24"
+fixed = "1.23"
+
+[[references]]
+type = "REPORT"
+url = "https://github.com/simonmichael/hledger/issues/1525"
+[[references]]
+type = "INTRODUCED"
+url = "https://github.com/simonmichael/hledger/commit/ec51d28839b2910eea360b1b8c72904b51cf7821"
+[[references]]
+type = "EVIDENCE"
+url = "https://www.youtube.com/watch?v=QnRO-VkfIic"
+[[references]]
+type = "FIX"
+url = "https://github.com/simonmichael/hledger/pull/1663"
+
+```
+
+# Stored XSS in *hledger-web*
+
+An issue was discovered in *hledger-web* < 1.23. A Stored Cross-Site
+Scripting (XSS) vulnerability exists in `toBloodhoundJson` that
+allows an attacker to execute JavaScript by encoding user-controlled
+values in a payload with base64 and parsing them with the `atob`
+function.
+
+*hledger-web* forms sanitise obvious JavaScript, but not obfuscated
+JavaScript (see [OWASP Filter Evasion Cheat Sheet][cheatsheet]).
+This means *hledger-web* instances, especially anonymously-writable
+ones like `demo.hledger.org`, could be loaded with malicious
+JavaScript to be executed by subsequent visitors.
+
+[cheatsheet]: https://owasp.org/www-community/xss-filter-evasion-cheatsheet
+
+Reported by Gaspard Baye and Hamidullah Muslih.  Fix by Arsen
+Arsenović.