Is CVE-2021-23342 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-23342 being exploited in the wild.

How severe is CVE-2021-23342?

Low severity, with a CVSS score of 3.1, published 1 March 2021.

Which products and versions are affected?

docsify (npm) SEMVER:introduced=0,fixed=4.12.0.

Is there a fix for CVE-2021-23342?

Yes. docsify (npm): upgrade to 4.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-23342 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-23342?

Check whether you run docsify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-23342: Docsify Cross-Site Scripting in sidebar via URL bypass

CVE-2021-23342 · Severity: low · CVSS 3.1 · Published 2021-03-01

Docsify, a popular documentation site generator, is vulnerable to a security flaw that allows attackers to run unauthorized scripts in a user's browser. By tricking a user into clicking a specially crafted link, an attacker could steal sensitive information like session cookies or perform actions on the user's behalf. This issue occurs because the software fails to properly clean content displayed in the sidebar and can be tricked into loading malicious files from external servers.

Technologies: docsify (npm). Vendors: npm.

Quick answers

Is CVE-2021-23342 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-23342 being exploited in the wild.
How severe is CVE-2021-23342?: Low severity, with a CVSS score of 3.1, published 1 March 2021.
Which products and versions are affected?: docsify (npm) SEMVER:introduced=0,fixed=4.12.0.
Is there a fix for CVE-2021-23342?: Yes. docsify (npm): upgrade to 4.12.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23342 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-23342?: Check whether you run docsify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

docsify (npm): upgrade to 4.12.0 or later
```
npm install docsify@4.12.0
```

Technical details

Docsify before version 4.12.1 contains a Cross-Site Scripting (XSS) vulnerability that bypasses previous fixes for CVE-2020-7680. The vulnerability exists in two parts: first, while the main page content is sanitized when parsing HTML from remote URLs, the sidebar component lacks this sanitization. Second, the 'isURL' check used to identify external links can be bypassed by using multiple forward slashes (e.g., '////'). An attacker can exploit this by hosting a malicious script on a remote server and crafting a Docsify URL that points to it. When a victim visits the link, the malicious script executes in their browser context. The issue is fixed in version 4.12.1 (note: some sources mention 4.12.0, but 4.12.1 is the confirmed complete fix).

Affected products

docsifyjs docsify < 4.12.1

Identifiers

CVE-2021-23342
GHSA-2mm9-c2fx-c7m4

Timeline

2021-02-18: disclosed: Vulnerability disclosed by Snyk
2021-02-19: advisory: NVD published CVE-2021-23342
2021-03-01: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.