Summary

The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This vulnerability enables attackers to perform cross-site scripting (XSS) attacks via DOM clobbering.

Details

During the rendering of user-provided HTML tags, the script sanitizer configuration lacks proper setup in terms of whitelisted attributes. Currently, the name attribute is permitted for iframe HTML tags. This inclusion is problematic as the name attributes of certain HTML tags, such as form and iframe, can overshadow the result of document object lookups (e.g., document.script) via DOM clobbering. DOM clobbering is a technique where HTML structure manipulations can alter JavaScript object properties unintentionally. For a comprehensive explanation of DOM clobbering, refer to DOM Clobbering Wiki.

https://github.com/hackmdio/codimd/blob/develop/public/js/render.js#L23
// allow ifram tag with some safe attributes
whiteList.iframe = ['allowfullscreen', 'name', 'referrerpolicy', 'src', 'width', 'height']

PoC

The victim will be alerted with document.cookie by clicking the following url (a shared notes).

• https://hackmd.io/YsI26fr6TA2vDTGl3OMQlQ

The payload:

<iframe name="scripts" src=”https://api.google.com/js/api.js”>alert(document.cookie)</iframe>
<iframe name="scripts" src=”https://api.google.com/js/api.js”>alert(document.cookie)</iframe>

Impact

Any user who opens a shared note containing the malicious payload from an attacker on Hackmd.io is susceptible to the effects of this vulnerability, such as having their cookies stolen.