Description
WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Musing Studio | WriteFreely | < 0.17.3 | 0.17.3 |
References
- GitHub Security Advisory (GHSA-cwxm-8ch5-j2vh) vendor-advisory
- https://github.com/writefreely/writefreely/commit/d7231d81a914f1314a218d5e8fde6e0341391ccd patch
- WriteFreely v0.17.3 Release Notes release-notes
- https://github.com/writefreely/writefreely/blob/v0.17.2/postrender.go#L117-L121 technical-description
- https://github.com/writefreely/writefreely/blob/v0.17.2/database.go#L702-L705 technical-description
- VulnCheck Advisory: WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug third-party-advisory