CVE-2023-41167: @webiny/react rich text renderer @webiny/react-rich-text-renderer Vulnerable To Insecure Rendering Vulnerability
MODERATECVE-2023-41167 is a MODERATE (CVSS 4.8) @webiny/react-rich-text-renderer vulnerable to insecure rendering vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) affecting @webiny/react rich text renderer libraries in the npm ecosystem. The issue involves @webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content. Remediation is available by upgrading affected packages to version 5.37.2.
CVE-2023-41167 at a Glance
Security Impact
CVSS: 4.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N).
How to Fix CVE-2023-41167
To remediate this vulnerability, upgrade all affected @webiny/react rich text renderer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @webiny/react-rich-text-renderer@5.37.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @webiny/react-rich-text-rendererHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2023-41167, inspect your project dependencies using npm:
npm ls @webiny/react-rich-text-rendererAnalyze the terminal output to locate any version of @webiny/react rich text renderer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 5.37.2), your application is affected.
Note: The npm ls @webiny/react-rich-text-renderer command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), where the product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. In @webiny/react rich text renderer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2023-41167 Affected @webiny/react rich text renderer Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@webiny/react-rich-text-renderer
|
npm |
< 5.37.2
|
5.37.2
|
References
Frequently Asked Questions
What is CVE-2023-41167?
Which @webiny/react rich text renderer versions are affected?
What version fixes CVE-2023-41167?
Is @webiny/react-rich-text-renderer affected?
What is the CVSS score of CVE-2023-41167?
What CWE is associated with CVE-2023-41167?
How can I check npm dependencies for CVE-2023-41167?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-3x59-vrmc-5mx6",
"modified" : "2023-08-31T18:51:43Z",
"published" : "2023-08-24T22:16:20Z",
"aliases" : [ "CVE-2023-41167" ],
"summary" : "@webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content",
"details" : "## Overview\n`@webiny/react-rich-text-renderer` is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. The `@webiny/react-rich-text-renderer` package depends on the [editor.js](https://editorjs.io/) rich text editor to handle rich text content. The CMS stores rich text content from the `editor.js` into the database. When the `@webiny/react-rich-text-renderer` is used to render such content, it uses the `dangerouslySetInnerHTML` prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.\n\n## Am I affected?\nYou will be affected if you're running a Webiny project created prior to `5.35.0` and you're using the legacy rich text editor (which uses `editor.js` library under the hood). If you've already switched to using the new rich text editor, powered by Lexical editor, you will not be affected by this.\n\n## How do I patch this vulnerability?\nUpdate to Webiny version `5.37.2`.\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@webiny/react-rich-text-renderer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "5.37.2"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 5.37.1"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/webiny/webiny-js/security/advisories/GHSA-3x59-vrmc-5mx6"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-41167"
}, {
"type" : "WEB",
"url" : "https://github.com/webiny/webiny-js/commit/8748bc53fe862bb03d4459ccc0be39084a5d35c0"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/webiny/webiny-js"
}, {
"type" : "WEB",
"url" : "https://webiny.com"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-79" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2023-08-24T22:16:20Z",
"nvd_published_at" : "2023-08-25T14:15:10Z"
}
}