Log in Start free

Vulnerability · Published Feb 13, 2023 · Assigned by GitHub_M

CVE-2023-25572React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`

Medium 5.4

In plain English

A medium-severity cross-site scripting in react-admin from marmelab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, are vulnerable to cross-site scripting. All React applications built with react-admin and using the `<RichTextField>` are affected. `<RichTextField>` outputs the field value using `dangerouslySetInnerHTML` without client-side sanitization. If the data isn't sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use `DOMPurify` to escape the HTML before outputting it with React and `dangerouslySetInnerHTML`. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the `<RichTextField>` by a custom field doing sanitization by hand.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmra-ui-materialui4.7.6GHSA-5jcr-82fh-339v
npmra-ui-materialui3.19.12GHSA-5jcr-82fh-339v
npmreact-admin3.19.12GHSA-5jcr-82fh-339v
npmreact-admin4.7.6GHSA-5jcr-82fh-339v

Affected products (as reported)

VendorProductVersions
marmelab react-admin < 3.19.12>= 4.0.0, < 4.7.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References