Junglewise Threat Intelligence

CVE-2023-25572: react-admin RichTextField Cross-Site Scripting

CVE-2023-25572 · Severity: low · CVSS 3.1 · Published 2023-02-14

Executive brief

react-admin's RichTextField component is used to display formatted text content in React admin dashboards. If a database or API returns untrusted HTML without server-side sanitization, attackers can inject malicious JavaScript that executes in end-users' browsers, potentially stealing session credentials, modifying page content, or redirecting to phishing sites. Applications are vulnerable unless they sanitize HTML server-side or upgrade to patched versions.

Technical details

The RichTextField component leverages React's dangerouslySetInnerHTML to render HTML content, but failed to perform client-side sanitization before rendering. The vulnerability is classified as Stored XSS (CWE-79): an attacker can inject malicious HTML/JavaScript via event handlers (onclick, onerror, onmouseover) or embedded script tags, which will execute in any user's browser that views the rendered content. Exploitation requires no special privileges and relies on user interaction (viewing the affected page); however, if rich text data containing payloads is stored in a database, the impact affects all subsequent viewers. Patches (versions 3.19.12 and 4.7.6) integrate DOMPurify to strip dangerous HTML elements and attributes before rendering. Workarounds include server-side HTML sanitization or implementing a custom field with DOMPurify.

Affected products

  • marmelab react-admin before 3.19.12, 4.0.0 to before 4.7.6
  • marmelab ra-ui-materialui before 3.19.12, 4.0.0 to before 4.7.6

Timeline

  • 2023-02-13: disclosed: Vulnerability publicly disclosed via GHSA-5jcr-82fh-339v
  • 2023-02-13: patched: Patches released: react-admin 3.19.12, 4.7.6 and ra-ui-materialui 3.19.12, 4.7.6

References