CVE-2024-36109 (published 2024-05-28T19:15Z)

CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown parser allows `<script>` tags to be included which execute when published. This issue has been addressed in commit `419862a9c9879c`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/sagemathinc/cocalc
commit_details: repo_url: https://github.com/sagemathinc/cocalc
author: William Stein
author_date: 2024-04-11 17:41:28+00:00
msg: fix XSS with Markdown on share server vulnerability

- https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
- this removes some math rendering support and may cause "user
  frustration", but it is worth it and the right thing to do.
repository: repo_url: https://github.com/sagemathinc/cocalc
repo_name: sagemathinc/cocalc
description: CoCalc: Collaborative Calculation in the Cloud
repo_language: TypeScript
owner: sagemathinc
file_changes: filename: html-ssr.tsx
change_type: ModificationType.MODIFY
diff: @@ -38,10 +38,16 @@ function getXSSOptions(urlTransform): IFilterXSSOptions | undefined {
   //   much as possible, while still supporting 3d graphics.
   return {
     stripIgnoreTagBody: true,
+    // SECURITY: whitelist note -- we had tried to explicitly allow mathjax script tags in sanitized html
+    // by whitelisting and scanning.  However, this didn't properly work (perhaps due to some update)
+    // and resulted in a security vulnerability:
+    //    https://github.com/sagemathinc/cocalc/security/advisories/GHSA-8w44-hggw-p5rf
+    // The fix is completley removing any whitelisting of any script tags.  The feature of
+    // mathjax in html is not important enough to support, and too dangerous -- even if it worked,
+    // it would probably be an easy attack vector by just making up fake mathjax.
     whiteList: {
       ...whiteList,
       iframe: ["src", "srcdoc", "width", "height"],
-      script: ["type"],
       html: [],
     },
     safeAttrValue: (tag, name, value) => {
@@ -49,16 +55,6 @@ function getXSSOptions(urlTransform): IFilterXSSOptions | undefined {
         // important not to mangle this or it won't work.
         return value;
       }
-      if (tag == "script" && name == "type") {
-        if (value.toLowerCase().startsWith("math/tex")) {
-          if (value.includes("display")) {
-            return "math/tex; mode=display";
-          } else {
-            return "math/tex";
-          }
-        }
-        return "";
-      }
       if (urlTransform && URL_TAGS.includes(name)) {
         // use the url transform
         return urlTransform(value, tag, name) ?? value;
@@ -180,7 +176,7 @@ export default function HTML({
               props,
               children && children?.length > 0
                 ? domToReact(children, options)
-                : undefined
+                : undefined,
             );
           }
         }

programming_language: TypeScript