GitHub Security Advisory: GHSA-867c-p784-5q6g
Package: privatebin/privatebin (COMPOSER)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Vulnerable versions: >= 1.7.7, < 2.0.2
Patched in: 2.0.2

Summary: PrivateBin is missing HTML sanitization of attached filename in file size hint

Details:
We’ve identified an HTML injection/XSS vulnerability in PrivateBin service that allows the injection of arbitrary HTML markup via the attached filename. Below are the technical details, PoC, reproduction steps, impact, and mitigation recommendations.

**Recommend action:** As the vulnerability has been fixed in the latest version, users are **strongly encouraged** to upgrade PrivateBin to the latest version _and_ [check](https://privatebin.info/directory/check) that a strong CSP header, just as the default suggested one, is delivered.

**Summary of the vulnerability:** The `attachment_name` field containing the attached file name is included in the object that the client encrypts and is eventually rendered in the DOM without proper escaping.

## Impact
The vulnerability allows attackers to inject arbitrary HTML into the filename displayed near the file size hint, when attachments are enabled. This is by definition [a XSS vulnerability (CWE-80)](https://cwe.mitre.org/data/definitions/80.html), in this case even a persistent XSS. As any HTML can be injected, basically, this can e.g. be used to inject [a script tag (as per CWE-79)](https://cwe.mitre.org/data/definitions/79.html).

That said, also due to [previous issues](#more-informaton), we have strong mitigations for this in place. The [content security policy (CSP)](https://content-security-policy.com/) does, if configured as recommend by the PrivateBin project, prevent any inline script execution, so the confidentiality of the paste is _not_ affected.

However, as the reporter demonstrated, even when script execution is blocked, an HTML injection can still be used for attacks such as:
* redirection using a meta redirect tag to redirect to a potentially malicious/attacker-controlled website
* defacement of the website
* phishing, in combination with the redirection to a clone of a PrivateBin phishing page or similar
* potential attacks on other services hosted on the same domain

This list is by no means meant to be exhaustive, other attacks should be considered possible, that is why we treat this issue as a serious issue, even if the CSP is supposed to block the most attacks.

> [!IMPORTANT]  
> Depending on the deployment, if the server has a different than the recommend CSP configured or the client (browser) somehow lacks a protection, the vulnerability can have much more serious impacts and potentially also allow XSS, which could mean the confidentiality of the PrivateBin instance is affected. 

## Technical Description

The front-end uses PrivateBin (client-side encryption) to format and encrypt data before sending. During the paste creation process, the client assembles a `cipherMessage` object containing, among other fields:
* `paste` -> paste text
* `attachment` -> file content (data-URI)
* `attachment_name` -> array with file names

Before encryption, the `ServerInteraction.setCipherMessage(cipherMessage)` function is called. By intercepting/altering the `cipherMessage` on the client im