Executive brief
Pandao Editor.md is a popular open-source markdown editor library used in web applications. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious JavaScript code through the iframe src attribute, which is then executed in users' browsers. This can lead to theft of cookies, session tokens, and other sensitive data, or enable account takeover and unauthorized actions on behalf of the victim.
Technical details
The vulnerability is a stored or reflected cross-site scripting (CWE-79) issue in Editor.md v1.5.0 and earlier versions. The root cause is insufficient input validation on the iframe src parameter, which allows an attacker to inject a JavaScript URI scheme (e.g., `javascript://%0aalert(document.cookie)`) that executes arbitrary code in the user's browser context. The attack requires no authentication but does require user interaction (the user must view the crafted markdown). An attacker can exploit this to execute arbitrary JavaScript, access browser storage, perform actions as the logged-in user, or redirect to malicious sites. The vulnerability has been tracked as CVE-2020-19697 and patch information is available via GitHub pull request #860.
Affected products
- Pandao Editor.md 1.5.0 and earlier
Timeline
- 2019-07-02: disclosed: Vulnerability reported on GitHub issue #701
- 2023-04-04: advisory: GHSA-w974-rq9x-mh3v published with CVSS 6.1 (Medium)
- 2023-04-04: other: CVE-2020-19697 assigned