Executive brief
Raneto is a popular open-source knowledge base and wiki platform. A cross-site scripting (XSS) vulnerability in version 0.17.0 and earlier could allow authenticated administrators to inject malicious scripts through search fields and file paths, potentially compromising user sessions or data when those pages are viewed by others. The vulnerability requires administrative access and user interaction, limiting its immediate risk but still requiring prompt patching.
Technical details
Raneto v0.17.0 and earlier contains a reflected/stored cross-site scripting (CWE-79) vulnerability in search sanitization and file path handling. The vulnerability allows authenticated administrators to inject unsanitized HTML/JavaScript through search functionality and page administration actions. An attacker with admin credentials can craft malicious payloads that execute in the browser context of users viewing affected pages. The issue is mitigated by the requirement for high-privilege (admin) access and user interaction (viewing a malicious page). The vulnerability was fixed in version 0.17.1, which implements proper HTML escaping and strips raw HTML in favor of Markdown-only content for new/updated pages.
Affected products
- Ryan Lelek Raneto 0.17.0 and earlier; fixed in 0.17.1
Timeline
- 2022-08-04: disclosed: Vulnerability disclosed by J-GainSec
- 2022-08-04: patched: Fixed in version 0.17.1 with security update PR #370