RevealJS postMessage <4.3.0 - Cross-Site Scripting

mediumseverity

6.1CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

RevealJS postMessage before 4.3.0 contains a cross-site scripting vulnerability via the document object model.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.

Fix

Upgrade to RevealJS postMessage version 4.3.0 or later to mitigate this vulnerability.

How to confirm it

Positive when: contains in extract "true"

Run it with nuclei: nuclei -id CVE-2022-0776 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-0776

info:
  name: RevealJS postMessage <4.3.0 - Cross-Site Scripting
  author: LogicalHunter
  severity: medium
  description: RevealJS postMessage before 4.3.0 contains a cross-site scripting vulnerability via the document object model.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft, session hijacking, or defacement of the affected website.
  remediation: |
    Upgrade to RevealJS postMessage version 4.3.0 or later to mitigate this vulnerability.
  reference:
    - https://hackerone.com/reports/691977
    - https://github.com/hakimel/reveal.js/pull/3137
    - https://huntr.dev/bounties/be2b7ee4-f487-42e1-874a-6bcc410e4001/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0776
    - https://github.com/hakimel/reveal.js/commit/32cdd3b1872ba8e2267c9e87ae216cb55f40f4d2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-0776
    cwe-id: CWE-79
    epss-score: 0.03679
    epss-percentile: 0.89769
    cpe: cpe:2.3:a:revealjs:reveal.js:*:*:*:*:*:node.js:*:*
  metadata:
    vendor: revealjs
    product: reveal.js
    framework: node.js
  tags: cve,cve2022,hackerone,huntr,headless,postmessage,revealjs,node.js,vuln
headless:
  - steps:
      - args:
          url: "{{BaseURL}}"
        action: navigate

      - action: waitload

      - action: script
        name: extract
        args:
          code: |
            () => {
            return (Reveal.VERSION <= "3.8.0" || Reveal.VERSION < "4.3.0")
            }
    matchers:
      - type: word
        part: extract
        words:
          - "true"

References

Use this check only on systems you are authorised to test. Where the data comes from