GHSA-7qcx-jmrc-h2rr

Cross-Site Scripting in keystone

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-15878

Packages

Ecosystem	Package	Affected	Fixed in
npm	keystone	< 4.0.0	4.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize user input on the `Contact Us` page, allowing attackers to submit contact forms with malicious JavaScript in the message field. The output is not properly encoded leading an admin that opens new inquiry to execute the arbitrary JavaScript supplied in their browser. ## Recommendation Update to version 4.0.0 or later.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2017-15878 advisory
https://github.com/keystonejs/keystone/pull/4478 web
https://github.com/advisories/GHSA-7qcx-jmrc-h2rr advisory
https://github.com/keystonejs/keystone package
https://packetstormsecurity.com/files/144756/KeystoneJS-4.0.0-beta.5-Unauthenticated-Stored-Cross-Site-Scripting.html web
https://securelayer7.net/download/pdf/KeystoneJS-Pentest-Report-SecureLayer7.pdf web
https://www.exploit-db.com/exploits/43054 web
https://www.npmjs.com/advisories/980 web
http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report web
http://www.securityfocus.com/bid/101541 web