CVE-2023-41167
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
CVE-2023-41167 vulnerability in @webiny/react-rich-text-renderer before version 5.37.2 allows XSS attacks by content managers. The issue arises from using the dangerouslySetInnerHTML prop without HTML sanitization, allowing for the injection of malicious scripts.
Risk Assessment
Organizations may be exposed to XSS attacks that could lead to user data theft or session hijacking. Content managers may unknowingly input malicious scripts, increasing the risk.
Recommendation
It is recommended to update @webiny/react-rich-text-renderer to version 5.37.2 or later to mitigate this vulnerability. Additionally, implementing HTML sanitization mechanisms for inputted content is advisable.
Original NVD description (English source)
@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the editor.js into the database. When the @webiny/react-rich-text-renderer is used to render such content, it uses the dangerouslySetInnerHTML prop, without applying HTML sanitization. The issue arises when an actor, who in this context would specifically be a content manager with access to the CMS, inserts a malicious script as part of the user-defined input. This script is then injected and executed within the user's browser when the main page or admin page loads.