Executive brief
docsify is a popular open-source documentation site generator used to create and host technical documentation with minimal setup. A cross-site scripting vulnerability in its fragment identifier (URL hash) processing allows attackers to inject arbitrary JavaScript code into documentation pages viewed by users, potentially enabling session hijacking, credential theft, or defacement of the documentation site.
Technical details
docsify prior to version 4.11.4 is vulnerable to reflected cross-site scripting (CWE-79) in its fragment identifier handling. The application uses URL fragments (parameters after the # sign) to dynamically load markdown resources from the server but fails to properly validate external URLs passed in these parameters. An attacker can craft a malicious URL (e.g., domain.com/#//attacker.com) that causes docsify to load and execute arbitrary JavaScript or render attacker-controlled HTML content within the context of the documentation page. The vulnerability requires user interaction (clicking a malicious link) and is network-accessible without authentication. The issue was fixed in version 4.11.4.
Affected products
- docsify docsify before 4.11.4
Timeline
- 2020-07-20: disclosed
- 2020: patched: Version 4.11.4 released with fix