{"id":"GHSA-m64q-4jqh-f72f","summary":"Stored Cross-site Scripting (XSS) in excalidraw's web embed component","details":"### Summary\n\nA stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. \n\n### Poc\n\nInserting an embed with the below url (can be copy/pasted onto canvas to insert as embed) will log `42` to the console:\n\n```\nhttps://gist.github.com/vv=v\u003cscript\u003econsole.log(42)\u003c/script\u003e\n```\n\n### Details\n\nThere were two vectors. One rendering untrusted string as iframe's `srcdoc` without properly sanitizing against HTML injection. Second by improperly sanitizing against attribute HTML injection. This in conjunction with allowing `allow-same-origin` sandbox flag (necessary for several embeds) resulted in the XSS.\n\nFormer was fixed by no longer rendering unsafe `srcdoc` content verbatim, and instead strictly parsing the supplied content and constructing the `srcdoc` manually. The latter by sanitizing properly.\n\nThe `allow-same-origin` flag is now also set only in cases that require it, following the principle of least privilege.\n\n### Impact\n\nThis is a cross site scripting vulnerability, for more information, please see: https://portswigger.net/web-security/cross-site-scripting\n\nTwo npm `@excalidraw/excalidraw` stable version releases were affected (`0.16.x`, `0.17.x`), and both are now patched.","aliases":["CVE-2024-32472"],"modified":"2024-04-18T00:31:04Z","published":"2024-04-17T21:32:57Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-04-17T21:32:57Z","nvd_published_at":"2024-04-17T22:15:08Z"},"references":[{"type":"WEB","url":"https://github.com/excalidraw/excalidraw/security/advisories/GHSA-m64q-4jqh-f72f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32472"},{"type":"WEB","url":"https://github.com/excalidraw/excalidraw/commit/6be752e1b6d776ccfbd3bb9eea17463cb264121d"},{"type":"WEB","url":"https://github.com/excalidraw/excalidraw/commit/988f81911ca58e3ca2583e0dd44a954dd00e09d0"},{"type":"PACKAGE","url":"https://github.com/excalidraw/excalidraw"}],"affected":[{"package":{"name":"@excalidraw/excalidraw","ecosystem":"npm","purl":"pkg:npm/%40excalidraw/excalidraw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.16.0"},{"fixed":"0.16.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-m64q-4jqh-f72f/GHSA-m64q-4jqh-f72f.json"}},{"package":{"name":"@excalidraw/excalidraw","ecosystem":"npm","purl":"pkg:npm/%40excalidraw/excalidraw"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.17.0"},{"fixed":"0.17.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-m64q-4jqh-f72f/GHSA-m64q-4jqh-f72f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}