Executive brief
Jingo is a wiki application that allows users to create and edit wiki pages. A flaw in how it processes user-supplied content allows attackers to inject malicious JavaScript code into wiki pages, which executes in the browsers of users viewing the page. This can lead to session hijacking, credential theft, or defacement of the wiki.
Technical details
Jingo versions prior to 1.9.2 are vulnerable to Stored Cross-Site Scripting (XSS) via improper input encoding in wiki page content. When malicious input such as <script>alert(1)</script> is placed in the content of a wiki page, Jingo fails to properly HTML-encode the input, allowing the script to execute in the browser rather than being rendered as plain text. The vulnerability affects all versions prior to 1.9.2. An attacker with the ability to create or edit wiki pages can inject arbitrary JavaScript, which will execute in the context of any user's browser that views the affected page, leading to potential account compromise or data theft.
Affected products
- jingo jingo prior to 1.9.2
Timeline
- 2020-09-01: disclosed