Executive brief
metascraper is a library used to extract metadata (titles, descriptions, images) from web pages. Before version 5.2.0, the library failed to properly escape HTML data when processing scraped content, allowing attackers to inject malicious scripts that persist in the extracted metadata and execute in users' browsers when that data is displayed.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in metascraper versions prior to 5.2.0, classified under CWE-79. The root cause is inadequate HTML escaping of user-supplied data extracted from web pages during scraping. The vulnerability requires an attacker to craft a malicious web page containing XSS payloads in metadata fields that will be scraped by metascraper; when the extracted data is later displayed by an application using metascraper, the injected script executes in the user's browser. The attack vector is network-based and requires user interaction (visiting a page that uses metascraper to display scraped content). The fix was implemented in version 5.2.0, which adds HTML escaping by default.
Affected products
- metascraper metascraper before 5.2.0
Timeline
- 2018-08-08: disclosed
- 2019-05-05: patched: Fix merged in PR #169