Executive brief
GitBook is a popular platform for creating and publishing online documentation and books. A flaw in its online reader fails to properly filter user-supplied content, allowing attackers to inject malicious JavaScript code into book pages. When readers view an infected page, the attacker's code executes in their browser, potentially allowing theft of login credentials, hijacking of user sessions, or defacement of content. This risk is particularly acute for books containing sensitive or technical information.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in GitBook's online reader, categorized as CWE-79. The root cause is improper input sanitization: GitBook fails to escape or filter HTML and JavaScript code that appears outside of code blocks (backticks). An attacker can inject arbitrary HTML/JavaScript into book content, which is then rendered and executed in the reader's browser without sanitization. The attack vector is network-based and requires user interaction (a victim must visit a malicious book page), but no authentication is required. An attacker can achieve JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, or malware distribution. The vulnerability was fixed in version 3.2.2 and later.
Affected products
- GitBook GitBook <3.2.2
Timeline
- 2016-11-25: disclosed: Issue #1609 reported on GitHub by bkimminich
- 2017: patched: Fixed in version 3.2.2 or later
- 2020-09-01: advisory: GHSA advisory published