^{CVE-2021-30637:}Stored XSS vulnerability in htmly 2.8.0 allowing attackers to inject malicious scripts via blog configuration fields.

Overview

The vulnerability (CVE-2021-30637) affects htmly version 2.8.0, a flat-file CMS and blog platform. The issue is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The vulnerability occurs because the application does not properly sanitize or validate user input in the blog configuration fields before storing it in the config.html.php file. When other users access pages that display this content, the malicious script executes in their browser context. This is particularly dangerous as it affects administrative configuration fields that are displayed throughout the application, potentially impacting all users of the system.

Remediation

To remediate this vulnerability, administrators should:

1. Update htmly to the latest version that includes patches for this vulnerability.
2. If immediate updating is not possible, implement input validation and output encoding for the affected fields:
   • Sanitize all input in the blog title, Tagline, and Description fields
   • Apply HTML encoding to these fields when displaying them on web pages
3. Consider implementing Content Security Policy (CSP) headers to mitigate the impact of XSS attacks
4. Review any existing content in these fields for potential malicious code
5. Regularly audit the application for similar vulnerabilities in other input fields

References

1. Packet Storm Security Advisory: http://packetstormsecurity.com/files/162195/htmly-2.8.0-Cross-Site-Scripting.html
2. GitHub Issue Report: https://github.com/danpros/htmly/issues/456
3. CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
4. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html