CVE-2021-21383
📋 TL;DR
Wiki.js versions before 2.5.191 are vulnerable to stored cross-site scripting (XSS) through mustache expressions in code blocks. Malicious users can create crafted wiki pages that execute JavaScript when viewed by other users, potentially compromising their accounts or sessions. This affects all Wiki.js deployments running vulnerable versions.
💻 Affected Systems
- Wiki.js
📦 What is this software?
Wiki.js by Requarks
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, deface wiki content, or redirect users to malicious sites, potentially leading to full account compromise.
Likely Case
Malicious users with edit permissions inject JavaScript that executes when other users view pages, potentially stealing session tokens or performing unauthorized actions.
If Mitigated
With proper user permission controls and content sanitization, impact is limited to users with edit access abusing their privileges.
🎯 Exploit Status
Exploitation requires authenticated user with edit permissions. Example exploit code is available in the GitHub advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.191
Vendor Advisory: https://github.com/Requarks/wiki/security/advisories/GHSA-6xx4-m8gx-826r
Restart Required: Yes
Instructions:
1. Backup your Wiki.js instance. 2. Update to version 2.5.191 or later using npm: 'npm update wiki.js'. 3. Restart the Wiki.js service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable user content editing
allTemporarily restrict or disable user permissions to create/edit wiki pages until patching is complete.
Content sanitization filter
allImplement server-side filtering to strip or escape mustache expressions in code blocks.
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to limit script execution
- Review and audit all user-created content for suspicious mustache expressions
🔍 How to Verify
Check if Vulnerable:
Check Wiki.js version in admin panel or run 'npm list wiki.js' to see if version is below 2.5.191.Check Version:
npm list wiki.js | grep wiki.jsVerify Fix Applied:
Verify version is 2.5.191 or higher and test that mustache expressions in code blocks no longer execute as JavaScript.📡 Detection & Monitoring
Log Indicators:
- Unusual page edit patterns
- Multiple failed login attempts followed by successful edits
- Administrative actions from unexpected user accounts
Network Indicators:
- Unexpected outbound connections from wiki server after page views
- Suspicious JavaScript payloads in HTTP requests
SIEM Query:
source="wiki.js" AND (event="page_edit" OR event="page_create") AND content CONTAINS "{{"🔗 References
- https://github.com/Requarks/wiki/commit/5ffa189383dd716f12b56b8cae2ba0d075996cf1
- https://github.com/Requarks/wiki/releases/tag/2.5.191
- https://github.com/Requarks/wiki/security/advisories/GHSA-6xx4-m8gx-826r
- https://github.com/Requarks/wiki/commit/5ffa189383dd716f12b56b8cae2ba0d075996cf1
- https://github.com/Requarks/wiki/releases/tag/2.5.191
- https://github.com/Requarks/wiki/security/advisories/GHSA-6xx4-m8gx-826r
