Is CVE-2019-12043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-12043 being exploited in the wild.

How severe is CVE-2019-12043?

Low severity, with a CVSS score of 3, published 29 May 2019.

Which products and versions are affected?

remarkable (npm) SEMVER:introduced=0,fixed=1.7.2.

Is there a fix for CVE-2019-12043?

Yes. remarkable (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-12043 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-12043?

Check whether you run remarkable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-12043: Remarkable Cross-site Scripting via unprintable characters in URLs

CVE-2019-12043 · Severity: low · CVSS 3 · Published 2019-05-29

Remarkable is a popular library used to convert Markdown text into HTML for display on websites. A security flaw in the way it handles web links allows an attacker to hide malicious scripts inside a link using invisible characters. If a user clicks on one of these specially crafted links, the attacker could steal their login information or perform actions on their behalf.

Technologies: remarkable (npm). Vendors: npm.

Quick answers

Is CVE-2019-12043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-12043 being exploited in the wild.
How severe is CVE-2019-12043?: Low severity, with a CVSS score of 3, published 29 May 2019.
Which products and versions are affected?: remarkable (npm) SEMVER:introduced=0,fixed=1.7.2.
Is there a fix for CVE-2019-12043?: Yes. remarkable (npm): upgrade to 1.7.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-12043 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-12043?: Check whether you run remarkable (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

remarkable (npm): upgrade to 1.7.2 or later
```
npm install remarkable@1.7.2
```

Technical details

A Cross-site Scripting (XSS) vulnerability exists in Remarkable versions prior to 1.7.2. The issue resides in 'lib/parser_inline.js' (and specifically 'parse_link_destination.js'), where the URL filtering logic failed to account for unprintable ASCII control characters. An attacker can bypass the 'javascript:' protocol filter by prefixing the URI with a control character (e.g., '\x0e'). When rendered and clicked in a browser, the control character is ignored or handled in a way that allows the JavaScript to execute. This is a network-reachable vulnerability requiring user interaction (clicking the link) to achieve execution in the context of the victim's session. The fix, introduced in version 1.7.2, updates the parser to disallow all ASCII control characters (code < 0x20 or 0x7F) in link destinations.

Affected products

jonschlinkert remarkable < 1.7.2

Identifiers

CVE-2019-12043
GHSA-36m4-6v6m-4vpr

Timeline

2019-05-13: disclosed: Issue reported on GitHub
2019-05-13: patched: Fix committed to repository
2019-05-29: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.