Stored XSS in Gogs via Malicious Jupyter Notebook Preview

Compliance Impact

The vulnerability in Gogs prior to version 0.14.3 allows for click-based Stored Cross-Site Scripting (XSS) via attacker-crafted .ipynb files. This can lead to arbitrary JavaScript execution in the context of the Gogs origin when a victim clicks a malicious link.

Such a vulnerability can impact compliance with common standards and regulations like GDPR and HIPAA because it may lead to unauthorized access or manipulation of sensitive data, compromise user privacy, and violate data protection requirements. The execution of arbitrary scripts could be used to steal user credentials, session tokens, or other sensitive information, thereby undermining the confidentiality and integrity of data.

Therefore, organizations using vulnerable versions of Gogs might face increased risk of non-compliance with these regulations until the vulnerability is remediated.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, in versions prior to 0.14.3. Although .ipynb file previews are sanitized on the server side, the content is re-rendered on the client side without proper sanitization. Specifically, links with dangerous schemes like javascript: can be regenerated during client-side rendering. When a user views a maliciously crafted .ipynb file and clicks such a link, arbitrary JavaScript code executes within the Gogs origin, resulting in a click-based Stored Cross-Site Scripting (XSS) attack.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary JavaScript execution in the context of the Gogs application. An attacker can exploit this by crafting malicious .ipynb files that, when viewed and interacted with by a victim, execute harmful scripts. This can result in unauthorized actions, data theft, session hijacking, or other malicious activities within the affected Gogs instance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Gogs to version 0.14.3 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your Gogs instance is running a vulnerable version (prior to 0.14.3) and if it allows uploading and previewing .ipynb files containing malicious javascript: links.

To detect exploitation attempts or presence of malicious .ipynb files, you can search your repositories for .ipynb files containing suspicious markdown links with javascript: schemes.

• Use git commands or file search tools to find .ipynb files with javascript: links, for example:
• grep -r --include="*.ipynb" "javascript:" /path/to/gogs-repositories
• Or use git grep inside a repository:
• git grep "javascript:" -- '*.ipynb'

Additionally, monitoring HTTP traffic for requests to the /-/api/sanitize_ipynb endpoint or suspicious client-side rendering behavior involving .nb-markdown-cell elements may help detect attempts to exploit this vulnerability.

Upgrading Gogs to version 0.14.3 or later is the recommended mitigation.

Useful 0 Not Useful 0