CVE-2021-23342
📋 TL;DR
This is a cross-site scripting (XSS) vulnerability in docsify documentation generators before version 4.12.0. Attackers can bypass previous security fixes to inject malicious JavaScript through sidebar content or URL parsing, potentially compromising user sessions. Anyone using vulnerable docsify versions for documentation websites is affected.
💻 Affected Systems
- docsify
📦 What is this software?
Docsify by Docsifyjs
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover, session hijacking, credential theft, and malware distribution to all website visitors through persistent XSS payloads.
Likely Case
Session hijacking, credential theft, and defacement of documentation sites through injected malicious scripts.
If Mitigated
Limited impact with proper content security policies and input validation, but still potential for limited script execution.
🎯 Exploit Status
Public exploit details available in security advisories with specific bypass techniques documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.12.0 and later
Vendor Advisory: https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe
Restart Required: No
Instructions:
1. Update docsify to version 4.12.0 or later using npm: npm update docsify 2. Verify the update completed successfully 3. Test documentation functionality
🔧 Temporary Workarounds
Disable remote URL loading
allPrevent docsify from loading content from remote URLs to block the primary attack vector
Configure docsify to only load local content files
Implement Content Security Policy
allAdd strict CSP headers to limit script execution sources
Add Content-Security-Policy header with script-src 'self'
🧯 If You Can't Patch
- Implement web application firewall rules to detect and block XSS payloads in URLs and sidebar content
- Disable sidebar functionality if not essential for documentation needs
🔍 How to Verify
Check if Vulnerable:
Check docsify version in package.json or via npm list docsifyCheck Version:
npm list docsify | grep docsifyVerify Fix Applied:
Confirm version is 4.12.0 or higher and test that remote URL content is properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual URL patterns with multiple slashes (////)
- JavaScript execution errors in sidebar context
- Unexpected remote content loading
Network Indicators:
- HTTP requests with malicious script patterns in query parameters
- Unusual content loading from external sources
SIEM Query:
web_logs WHERE url CONTAINS '////' OR url CONTAINS '<script' OR user_agent CONTAINS 'docsify'🔗 References
- http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2021/Feb/71
- https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076593
- https://snyk.io/vuln/SNYK-JS-DOCSIFY-1066017
- http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2021/Feb/71
- https://github.com/docsifyjs/docsify/commit/ff2a66f12752471277fe81a64ad6c4b2c08111fe
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1076593
- https://snyk.io/vuln/SNYK-JS-DOCSIFY-1066017
