Vulnerability · Published Aug 9, 2021 · Assigned by GitHub_M
CVE-2021-37634LeafKit allows XSS with untrusted user input
High 7.4
In plain English
A high-severity cross-site scripting in leaf-kit from vapor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an attacker managed to find a variable that was rendered with their unsanitised data, they could inject scripts into a generated Leaf page, which could enable XSS attacks if other mitigations such as a Content Security Policy were not enabled. This has been patched in 1.3.0. As a workaround sanitize any untrusted input before passing it to Leaf and enable a CSP to block inline script and CSS data.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
References
- https://github.com/vapor/leaf-kit/security/advisories/GHSA-rv3x-xq3r-8j9h x_refsource_CONFIRM
- https://github.com/vapor/leaf-kit-ghsa-rv3x-xq3r-8j9h/pull/1 x_refsource_MISC