Stored XSS viva cshtm file upload in star7th/showdoc

The XSS vulnerability in Showdoc arises from insufficient sanitization of user-uploaded cshtm files. An attacker can upload a malicious cshtm file containing JavaScript code. When a user views the uploaded file, the embedded script executes within their browser context, allowing the attacker to steal cookies, redirect the user to a malicious website, or perform actions on their behalf. The impact is significant, potentially leading to complete account compromise and unauthorized access to sensitive data stored within Showdoc. This vulnerability is particularly concerning given Showdoc’s potential use in internal documentation and knowledge management systems, where sensitive information is often stored.

Organizations using Showdoc for internal documentation or knowledge management, particularly those running versions prior to 2.10.4, are at risk. Shared hosting environments where multiple users can upload files are especially vulnerable, as a compromised account could be used to inject malicious scripts affecting other users.

• php / server:

find /var/www/showdoc/uploads/ -name '*.cshtm' -print0 | xargs -0 grep -i '<script>' 

• generic web:

curl -I 'http://your-showdoc-instance/uploads/malicious.cshtm' | grep 'Content-Type:'

1. 2022-03-14Disclosure

   disclosure

2. 2022-03-14Patch

   patch

1. 已保留2022-03-14
2. 发布日期2022-03-14
3. 修改日期2024-08-02
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-0946 is to upgrade Showdoc to version 2.10.4 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. These may include restricting file uploads to trusted sources, implementing strict input validation on all user-provided data, and utilizing a Web Application Firewall (WAF) to filter out potentially malicious requests. Carefully review any third-party plugins or extensions for Showdoc, as they may introduce additional vulnerabilities. After upgrading, confirm the fix by attempting to upload a test cshtm file containing a simple JavaScript alert and verifying that the alert does not execute.