Executive brief
reveal.js is a popular open-source presentation framework used to create interactive web-based slideshows. The library fails to properly validate messages received through cross-origin communication (postMessage API), allowing attackers to inject malicious scripts that execute in the context of a presentation. An attacker can exploit this by hosting a malicious webpage that communicates with a reveal.js presentation, potentially stealing session data or taking actions on behalf of the user.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw stemming from insufficient input validation in reveal.js's postMessage event handler. The postMessage API allows cross-origin communication between windows/frames, but reveal.js version 3.9.1 and earlier does not adequately sanitize or validate messages before processing them. An attacker can craft a malicious HTML page that opens or frames a reveal.js presentation and sends specially crafted postMessage events that result in script execution within the presentation's origin. This requires user interaction (the user must visit the attacker's page or have a presentation open in another tab). The vulnerability was fixed in version 3.9.2.
Affected products
- reveal.js reveal.js 3.9.1 and earlier
Timeline
- 2020-02-28: disclosed: Published to NVD
- 2021-05-10: patched: Advisory published; version 3.9.2 contains the fix