Executive brief
CyberChef is a web-based toolkit used for encoding, decoding, and data transformation tasks. A cross-site scripting vulnerability in the Text Encoding Brute Force feature allows attackers to inject and execute arbitrary JavaScript code in a user's browser by crafting malicious input, potentially leading to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the Text Encoding Brute Force functionality. The vulnerable component concatenates user-supplied input directly into HTML table rows without proper sanitization or escaping. An attacker can craft input containing JavaScript payloads (e.g., <script>alert('XSS')</script>) that execute in the victim's browser when processed by the feature. This requires user interaction (victim must use the affected feature with attacker-controlled input) over a network vector. The vulnerability was fixed in version 8.31.3; users should upgrade immediately.
Affected products
- GCHQ CyberChef prior to 8.31.3
Timeline
- 2019-04-12: disclosed: Issue #539 reported on GitHub
- 2019-08-27: patched: Fixed in version 8.31.3
- 2019-08-27: advisory