CVE-2020-7680
MEDIUMdocsify < 4.11.4 - Cross-Site Scripting via Fragment Identifier
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-7680. PoCs published by Amin Sharifi.
AI-analyzed exploit summary This exploit demonstrates a DOM-based XSS vulnerability in Docsify.js 4.11.4 by leveraging fragment identifiers to load external URLs and render arbitrary JavaScript/HTML. The PoC uses a Flask server to host a malicious README.md file with an XSS payload, which is then rendered by the target Docsify.js application.
Description
docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
Exploits (1)
This exploit demonstrates a DOM-based XSS vulnerability in Docsify.js 4.11.4 by leveraging fragment identifiers to load external URLs and render arbitrary JavaScript/HTML. The PoC uses a Flask server to host a malicious README.md file with an XSS payload, which is then rendered by the target Docsify.js application.
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N