CVE-2020-26210
📋 TL;DR
This vulnerability allows authenticated users with page edit permissions in BookStack to inject malicious JavaScript links into pages. When other users click these links, arbitrary code executes in their browser context. All BookStack instances running versions before 0.30.4 are affected.
💻 Affected Systems
- BookStack
📦 What is this software?
Bookstack by Bookstackapp
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as other users, redirect to phishing sites, or compromise user accounts through cross-site scripting attacks.
Likely Case
Malicious users with edit permissions could embed JavaScript that steals credentials or performs unauthorized actions when clicked by administrators or other users.
If Mitigated
With proper access controls limiting edit permissions to trusted users only, exploitation risk is reduced but not eliminated for existing malicious content.
🎯 Exploit Status
Exploitation requires authenticated user with edit permissions. Proof of concept available in advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.30.4
Vendor Advisory: https://github.com/BookStackApp/BookStack/security/advisories/GHSA-7p2j-4h6p-cq3h
Restart Required: Yes
Instructions:
1. Backup your BookStack instance and database. 2. Update to version 0.30.4 or later. 3. Run the SQL query from advisory to check for exploitation. 4. Restart the application.
🔧 Temporary Workarounds
Limit Edit Permissions
allRestrict page edit permissions to only trusted users until patching is complete.
🧯 If You Can't Patch
- Audit all pages for suspicious links and remove any malicious content
- Implement strict Content Security Policy headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check BookStack version. If below 0.30.4, you are vulnerable. Run SQL query from advisory to check for exploitation: SELECT * FROM page_revisions WHERE html LIKE '%javascript:%' OR html LIKE '%data:text/html%'Check Version:
Check BookStack admin panel or view composer.json versionVerify Fix Applied:
Confirm version is 0.30.4 or higher. Test that JavaScript links in page attachments no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual page edits by users with edit permissions
- Multiple failed login attempts following page views
Network Indicators:
- Outbound connections to suspicious domains after clicking BookStack links
SIEM Query:
source="bookstack" AND (event="page_edit" OR event="link_click") | stats count by user🔗 References
- https://bookstackapp.com/blog/beta-release-v0-30-4/
- https://github.com/BookStackApp/BookStack/commit/349162ea139556b2d25e09e155cec84e21cc9227
- https://github.com/BookStackApp/BookStack/releases/tag/v0.30.4
- https://github.com/BookStackApp/BookStack/security/advisories/GHSA-7p2j-4h6p-cq3h
- https://bookstackapp.com/blog/beta-release-v0-30-4/
- https://github.com/BookStackApp/BookStack/commit/349162ea139556b2d25e09e155cec84e21cc9227
- https://github.com/BookStackApp/BookStack/releases/tag/v0.30.4
- https://github.com/BookStackApp/BookStack/security/advisories/GHSA-7p2j-4h6p-cq3h
