Executive brief
Hexo is a popular static site generator for building blogs and documentation. The include_code tag plugin contains a path traversal vulnerability that allows attackers to read arbitrary files from the server during site compilation. An attacker with the ability to inject malicious template content could expose sensitive files, potentially compromising site credentials, source code, or other confidential information.
Technical details
Hexo versions up to 7.1.1 contain a path traversal vulnerability in the include_code tag plugin (CWE-22). The vulnerability stems from insufficient validation of file paths, allowing directory traversal sequences (../ and ..\ on Windows) to bypass a basic security check. An attacker can craft a malicious include_code directive with path traversal sequences to read arbitrary files outside the intended directory. The vulnerability requires no authentication and can be exploited if an attacker can inject content into a template or markdown file processed by Hexo. The issue was fixed in version 7.2.0.
Affected products
- Hexo Hexo up to 7.1.1
Timeline
- 2023-09-08: disclosed: Vulnerability published as GHSA-x2jc-989c-47q4 and CVE-2023-39584
- 2023-09-08: patched: Fixed in Hexo version 7.2.0