Executive brief
KeystoneJS is a Node.js content management system and headless CMS platform. A flaw in the "Contact Us" page allows attackers to inject malicious JavaScript into contact form messages. When an administrator opens the inquiry in their browser, the attacker's script executes with the admin's privileges, potentially compromising account security or enabling unauthorized administrative actions.
Technical details
The vulnerability is a stored Cross-Site Scripting (XSS) flaw (CWE-79) in KeystoneJS versions prior to 4.0.0. The Contact Us form fails to sanitize user input in the message field, and admin-facing output is not properly HTML-encoded. An unauthenticated attacker can submit a contact form with arbitrary JavaScript, which is stored and later executed when an administrator opens the inquiry in their browser. This requires user interaction (admin viewing the message) and affects the confidentiality and integrity of the application. The vulnerability was fixed in version 4.0.0.
Affected products
- KeystoneJS keystone prior to 4.0.0
Timeline
- 2017-11-15: disclosed
- 2017: patched: Fixed in version 4.0.0