Executive brief
Fava, a web interface for the Beancount accounting tool, is vulnerable to a security flaw where malicious code can be injected into the application. An attacker could trick a user into clicking a specially crafted link, allowing the attacker to execute scripts in the user's browser session. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in Fava prior to version 1.22. The vulnerability is located in the handling of 'time' and 'filter' parameters, where error messages containing these parameters were rendered in the UI without proper HTML escaping. An attacker can exploit this by crafting a malicious URL containing JavaScript and persuading a victim to visit it. The root cause was the use of the '|safe' filter in Jinja2 templates and a general lack of output encoding for error strings. Successful exploitation allows for arbitrary script execution in the context of the victim's browser. A fix is available in version 1.22 which removes unsafe template filters and ensures proper escaping.
Affected products
- beancount fava < 1.22
Timeline
- 2022-07-25: advisory: NVD published CVE-2022-2514
- 2022-07-26: disclosed: GitHub Advisory published
- 2022-07-26: patched: Version 1.22 released
References
- https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711
- https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429
- https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-239.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/fava/PYSEC-2022-43182.yaml