CVE-2021-21383 : Security Advisory and Response

Wiki.js, an open-source wiki app built on Node.js, before version 2.5.191 is vulnerable to stored cross-site scripting (XSS) through mustache expressions in code blocks. This vulnerability allows attackers to execute malicious JavaScript by creating a crafted wiki page.

Understanding CVE-2021-21383

Wiki.js is vulnerable to XSS attacks due to improper neutralization of input during web page generation.

What is CVE-2021-21383?

CVE-2021-21383 refers to a stored cross-site scripting vulnerability in Wiki.js versions prior to 2.5.191. It enables malicious users to execute harmful scripts through specially crafted wiki pages.

The Impact of CVE-2021-21383

The impact of this vulnerability is rated as HIGH. Attackers can manipulate mustache expressions in code blocks to execute malicious scripts, potentially compromising the integrity of the application.

Technical Details of CVE-2021-21383

The vulnerability allows stored XSS attacks by injecting malicious scripts through mustache expressions in code blocks within Wiki.js. The fix for this issue involves adding the v-pre directive to all

<pre>

tags during the render.

Vulnerability Description

The vulnerability arises from mustache expressions being parsed by Vue, allowing attackers to execute malicious JavaScript when other users view the page.

Affected Systems and Versions

Wiki.js versions earlier than 2.5.191 are impacted by this XSS vulnerability through mustache expressions in code blocks.

Exploitation Mechanism

Malicious Wiki.js users can create crafted wiki pages containing malicious mustache expressions in code blocks to launch a stored cross-site scripting attack.

Mitigation and Prevention

To mitigate the risk associated with CVE-2021-21383, users should take immediate steps, adopt long-term security practices, and ensure timely patching and updates.

Immediate Steps to Take

Users are advised to update Wiki.js to version 2.5.191 or later to prevent exploitation of this vulnerability. Additionally, sanitizing user inputs and implementing input validation can help mitigate XSS risks.

Long-Term Security Practices

Employing secure coding practices, conducting regular security audits, and educating users on safe browsing habits can enhance the application's overall security posture.

Patching and Updates

Regularly monitoring security advisories and promptly applying patches released by Requarks can help protect Wiki.js from known vulnerabilities.