Executive Summary

This vulnerability exists in Shaarli, a personal bookmarking service, in versions 0.16.1 and earlier. It is a stored Cross-Site Scripting (XSS) vulnerability that occurs during the Markdown-to-HTML conversion process in the Bookmark Description field.

An authenticated user can inject a malicious javascript: URI inside a Markdown link. The vulnerability arises because the filterProtocols method, which is supposed to sanitize Markdown links by filtering dangerous protocols like javascript:, uses a regular expression that only detects inline Markdown links but fails to detect reference-style Markdown links.

Since the filterProtocols method does not inspect the actual URLs used in reference-style links, an attacker can supply a malicious javascript: URI inside a reference definition, which then gets executed when the Markdown is rendered.

This issue was fixed in version 0.16.2 of Shaarli.

Useful 0 Not Useful 0

Impact Analysis

This stored Cross-Site Scripting (XSS) vulnerability can allow an authenticated attacker to inject malicious JavaScript code into the Bookmark Description field.

When other users view the affected bookmark, the malicious script can execute in their browsers, potentially leading to theft of sensitive information, session hijacking, or performing actions on behalf of the victim user.

Because the vulnerability requires authenticated access and user interaction (UI:R), the risk is somewhat limited but still significant, especially in environments where multiple users share access to the Shaarli service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Shaarli to version 0.16.2 or later, as this version contains the fix for the stored Cross-Site Scripting (XSS) issue in the Markdown-to-HTML conversion process.

Useful 0 Not Useful 0