Stored XSS viva .ofd file upload in star7th/showdoc

An attacker can exploit this vulnerability by uploading a specially crafted .ofd file to a Showdoc instance. This file contains malicious JavaScript code that will be executed in the context of the user's browser when they view the uploaded file. This can lead to a variety of attacks, including session hijacking, where the attacker gains control of the user's account. The attacker could also inject malicious scripts into the Showdoc interface, potentially defacing the website or redirecting users to phishing sites. The blast radius extends to all users who interact with the vulnerable Showdoc instance, making it a significant security risk.

Organizations using Showdoc for documentation management, particularly those running older, unpatched versions (≤2.10.4), are at significant risk. Shared hosting environments where multiple users share the same Showdoc installation are especially vulnerable, as a single compromised account could impact all users.

• php / server:

find /var/www/showdoc -name '*.ofd' -print0 | xargs -0 grep -iE '<script' 

• generic web:

curl -I 'http://your-showdoc-instance/uploads/malicious.ofd' | grep 'Content-Type:'

1. 2022-03-15Disclosure

   disclosure

2. 2022-03-15Patch

   patch

1. Reservado2022-03-14
2. Publicada2022-03-15
3. Modificada2024-08-02
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2022-0965 is to upgrade Showdoc to version 2.10.4 or later, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing strict input validation on uploaded files, specifically .ofd files, to prevent the injection of malicious code. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly scan Showdoc installations for vulnerabilities using automated security tools.