Vulnerability · Published May 20, 2024 · Assigned by GitHub_M

CVE-2024-34710Wiki.js Stored XSS through Client Side Template Injection

High 7.1

In plain English

A high-severity security flaw in wiki from requarks. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 66.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection of a invalid HTML tag with a template injection payload on the next line. This vulnerability is fixed in 2.5.303.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/requarks/wiki	no fix listed	GO-2024-2875

Affected products (as reported)

Vendor	Product	Versions
requarks	wiki	<= 2.5.302

Weakness: CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/requarks/wiki/security/advisories/GHSA-xjcj-p2qv-q3rf x_refsource_CONFIRM
https://github.com/requarks/wiki/commit/1238d614e1599fefadd4614ee4b5797a087f50ac x_refsource_MISC