Summary
Two issues in hledger-web's add form and add API:
-
(#2700, high) The add form's error message was rendered as raw HTML, and it
echoes the entry that was submitted. A malicious web page can use this to
run javascript in hledger-web's origin. No authentication, no CSRF token,
and no user action beyond visiting the page are required.
-
(#2704, moderate) A newline in a submitted description, code, or account
name was written into the journal file, where the text after it was read
back as a journal directive rather than as part of the entry. This requires
add permission.
Impact
hledger-web has no authentication, so script running in its origin has the
same access as the person who started the server: it can read the whole
journal - every transaction, account and balance - and send it elsewhere, and
can write to the journal files at whatever level --allow permits (appending
by default, rewriting whole files with --allow=edit or all).
The second issue lets a client with add permission add a directive such as an
include to the journal, making hledger read an attacker-chosen file on the
next load, or stopping the journal from loading at all.
Affected versions
hledger-web 1.18 through 1.52.2, and 1.99.1 through 1.99.3 (the 2.x preview
series). Earlier versions are not affected.
Patched versions
hledger-web 1.52.3, and the next 2.x preview release.
Workarounds
Run hledger-web with --allow=view, which refuses both of the affected
requests. Otherwise, avoid leaving hledger-web running while browsing the web,
and do not expose its port to untrusted networks.
References
Credits
Arthur Cinader found and fixed the XSS.
Simon Michael extended the analysis, fixed more, and prepared the release.
Summary
Two issues in hledger-web's add form and add API:
(#2700, high) The add form's error message was rendered as raw HTML, and it
echoes the entry that was submitted. A malicious web page can use this to
run javascript in hledger-web's origin. No authentication, no CSRF token,
and no user action beyond visiting the page are required.
(#2704, moderate) A newline in a submitted description, code, or account
name was written into the journal file, where the text after it was read
back as a journal directive rather than as part of the entry. This requires
add permission.
Impact
hledger-web has no authentication, so script running in its origin has the
same access as the person who started the server: it can read the whole
journal - every transaction, account and balance - and send it elsewhere, and
can write to the journal files at whatever level
--allowpermits (appendingby default, rewriting whole files with
--allow=editorall).The second issue lets a client with add permission add a directive such as an
includeto the journal, making hledger read an attacker-chosen file on thenext load, or stopping the journal from loading at all.
Affected versions
hledger-web 1.18 through 1.52.2, and 1.99.1 through 1.99.3 (the 2.x preview
series). Earlier versions are not affected.
Patched versions
hledger-web 1.52.3, and the next 2.x preview release.
Workarounds
Run hledger-web with
--allow=view, which refuses both of the affectedrequests. Otherwise, avoid leaving hledger-web running while browsing the web,
and do not expose its port to untrusted networks.
References
https://github.com/plaintextaccounting/hledger/releases/tag/1.52.3
Credits
Arthur Cinader found and fixed the XSS.
Simon Michael extended the analysis, fixed more, and prepared the release.