Executive brief
Read the Docs is a documentation hosting platform used by thousands of open-source projects. A vulnerability in the download handler allowed malicious users to serve arbitrary HTML/JavaScript from the main domain. An attacker could trick a logged-in user into visiting a specially crafted URL, which would execute JavaScript in the user's session, enabling account compromise and unauthorized API access.
Technical details
The vulnerability is a path traversal and XSS issue (CWE-79, CWE-22) in the code that serves downloadable documentation files. The vulnerable component accepts a user-supplied `type_` parameter without proper validation, allowing an attacker to craft URLs like `https://readthedocs.org/projects/attacker-project/downloads/html/version-with-javascript-attack/` that serve arbitrary HTML files from the main domain. The root cause is in the `get_storage_path` function which concatenates user input directly with project/version slugs. Exploitation requires social engineering to trick a logged-in user into visiting the malicious URL, which would then execute JavaScript in the attacker's chosen context. The vulnerability was patched in version 8.8.1 by restricting the `type_` parameter to allowed values.
Affected products
- Read the Docs Read the Docs < 8.8.1
Timeline
- 2022-11-10: disclosed
- 2022-11-10: patched: Fixed in version 8.8.1