CVE-2021-29503
📋 TL;DR
This CVE describes a stored cross-site scripting (XSS) vulnerability in HedgeDoc's YAML metadata processing. Attackers with write access to notes can inject malicious JavaScript via Open Graph metadata, which gets executed when other users view the note. The vulnerability affects instances with guest editing enabled (unauthenticated attackers) or any instance where authenticated users have write access to notes.
💻 Affected Systems
- HedgeDoc
📦 What is this software?
Hedgedoc by Hedgedoc
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform account takeover, redirect users to malicious sites, or execute arbitrary actions on behalf of victims within the HedgeDoc instance.
Likely Case
Attackers would typically steal session tokens to gain unauthorized access to user accounts, potentially compromising sensitive notes and data.
If Mitigated
With guest editing disabled and proper access controls, only authenticated users with write permissions could exploit, limiting the attack surface.
🎯 Exploit Status
The vulnerability is straightforward to exploit by anyone with write access to notes. Public proof-of-concept exists in the advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.8.2
Vendor Advisory: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq
Restart Required: Yes
Instructions:
1. Backup your HedgeDoc instance and database. 2. Update to version 1.8.2 or later using your package manager or by downloading from GitHub releases. 3. Restart the HedgeDoc service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable Guest Editing
allPrevents unauthenticated users from creating or editing notes, which blocks the most common attack vector.
Edit your HedgeDoc configuration file (config.json) and set "allowAnonymous" to false
🧯 If You Can't Patch
- Disable guest editing in configuration to prevent unauthenticated exploitation
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if HedgeDoc version is below 1.8.2. Review configuration to see if guest editing is enabled.Check Version:
Check the HedgeDoc web interface footer or run: npm list hedgedoc (if installed via npm)Verify Fix Applied:
Confirm HedgeDoc version is 1.8.2 or higher. Test that HTML/JavaScript in YAML metadata is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual note creation/editing patterns
- Requests containing suspicious YAML metadata with script tags
Network Indicators:
- Outbound connections to unexpected domains from HedgeDoc users
- Unusual POST requests to note editing endpoints
SIEM Query:
source="hedgedoc" AND ("YAML" OR "metadata") AND ("script" OR "javascript" OR "onload")🔗 References
- https://github.com/hedgedoc/hedgedoc/commit/01dad5821ee28377ebe640c6c72c3e0bb0d51ea7
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq
- https://github.com/hedgedoc/hedgedoc/commit/01dad5821ee28377ebe640c6c72c3e0bb0d51ea7
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-gjg7-4j2h-94fq
