CVE-2024-36109: Insufficient Information (NVD-CWE-noinfo)
value: CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown parser allows `<script>` tags to be included which execute when published. This issue has been addressed in commit `419862a9c9879c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-28T19:15Z
Repository: https://github.com/sagemathinc/cocalc
Language: Other
Files changed: src/packages/frontend/components/html-ssr.tsx
Commit date: 2024-04-11 17:41:28 +0000
Commit message: fix XSS with Markdown on share server vulnerability

- https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
- this removes some math rendering support and may cause "user
  frustration", but it is worth it and the right thing to do.

Diff: diff --git a/src/packages/frontend/components/html-ssr.tsx b/src/packages/frontend/components/html-ssr.tsx
index a61ec628df..0dedbb601c 100644
--- a/src/packages/frontend/components/html-ssr.tsx
+++ b/src/packages/frontend/components/html-ssr.tsx
@@ -36,31 +36,27 @@ function getXSSOptions(urlTransform): IFilterXSSOptions | undefined {
   //   nothing would be better).
   // - whiteList - we need iframes, though we lock them down as
   //   much as possible, while still supporting 3d graphics.
   return {
     stripIgnoreTagBody: true,
+    // SECURITY: whitelist note -- we had tried to explicitly allow mathjax script tags in sanitized html
+    // by whitelisting and scanning.  However, this didn't properly work (perhaps due to some update)
+    // and resulted in a security vulnerability:
+    //    https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
+    // The fix is completley removing any whitelisting of any script tags.  The feature of
+    // mathjax in html is not important enough to support, and too dangerous -- even if it worked,
+    // it would probably be an easy attack vector by just making up fake mathjax.
     whiteList: {
       ...whiteList,
       iframe: ["src", "srcdoc", "width", "height"],
-      script: ["type"],
       html: [],
     },
     safeAttrValue: (tag, name, value) => {
       if (tag == "iframe" && name == "srcdoc") {
         // important not to mangle this or it won't work.
         return value;
       }
-      if (tag == "script" && name == "type") {
-        if (value.toLowerCase().startsWith("math/tex")) {
-          if (value.includes("display")) {
-            return "math/tex; mode=display";
-          } else {
-            return "math/tex";
-          }
-        }
-        return "";
-      }
       if (urlTransform && URL_TAGS.includes(name)) {
         // use the url transform
         return urlTransform(value, tag, name) ?? value;
       }
       // fallback to the builtin version
@@ -178,11 +174,11 @@ export default function HTML({
             return React.createElement(
               name,
               props,
               children && children?.length > 0
                 ? domToReact(children, options)
-                : undefined
+                : undefined,
             );
           }
         }
       }
     }

Vulnerable code:       script: ["type"],
      if (tag == "script" && name == "type") {
        if (value.toLowerCase().startsWith("math/tex")) {
          if (value.includes("display")) {
            return "math/tex; mode=display";
          } else {
            return "math/tex";
          }
        }
        return "";
      }
                : undefined
Fixed code:     // SECURITY: whitelist note -- we had tried to explicitly allow mathjax script tags in sanitized html
    // by whitelisting and scanning.  However, this didn't properly work (perhaps due to some update)
    // and resulted in a security vulnerability:
    //    https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
    // The fix is completley removing any whitelisting of any script tags.  The feature of
    // mathjax in html is not important enough to support, and too dangerous -- even if it worked,
    // it would probably be an easy attack vector by just making up fake mathjax.
                : undefined,