[advisory]
id = "HSEC-2023-0008"
cwe = [87]
keywords = ["web", "xss", "historical"]
aliases = ["CVE-2021-46888"]

[[affected]]
package = "hledger-web"
cvss = "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
[[affected.versions]]
introduced = "0.24"
fixed = "1.23"

[[references]]
type = "REPORT"
url = "https://github.com/simonmichael/hledger/issues/1525"
[[references]]
type = "INTRODUCED"
url = "https://github.com/simonmichael/hledger/commit/ec51d28839b2910eea360b1b8c72904b51cf7821"
[[references]]
type = "EVIDENCE"
url = "https://www.youtube.com/watch?v=QnRO-VkfIic"
[[references]]
type = "FIX"
url = "https://github.com/simonmichael/hledger/pull/1663"

Stored XSS in hledger-web

An issue was discovered in hledger-web < 1.23. A Stored Cross-Site Scripting (XSS) vulnerability exists in toBloodhoundJson that allows an attacker to execute JavaScript by encoding user-controlled values in a payload with base64 and parsing them with the atob function.

hledger-web forms sanitise obvious JavaScript, but not obfuscated JavaScript (see OWASP Filter Evasion Cheat Sheet). This means hledger-web instances, especially anonymously-writable ones like demo.hledger.org, could be loaded with malicious JavaScript to be executed by subsequent visitors.

Reported by Gaspard Baye and Hamidullah Muslih. Fix by Arsen Arsenović.