Executive brief
Excalidraw is a popular open-source whiteboarding application. The library was vulnerable to cross-site scripting (XSS) attacks through improperly sanitized links embedded in whiteboard objects, allowing attackers to inject malicious scripts that could execute in users' browsers and steal data or perform unauthorized actions.
Technical details
The vulnerability is a CWE-79 cross-site scripting (XSS) flaw in @excalidraw/excalidraw where embedded links in whiteboard objects were not properly sanitized. The root cause was insufficient input validation in the link normalization logic. An attacker can craft a whiteboard containing a malicious link that, when opened by a user, executes arbitrary JavaScript in the context of the web application. The attack requires user interaction (clicking the link) and is network-reachable. The fix was implemented in version 0.15.3 via stronger enforcement of the normalizeLink function.
Affected products
- Excalidraw excalidraw 0.0.0 to 0.15.2
Timeline
- 2023-08-16: disclosed
- 2023-06-29: patched: Fix merged in PR #6728
- 2023-08-16: other: Advisory withdrawn as duplicate of GHSA-v7v8-gjv7-ffmr