CVE-2014-3743

Overview

CVE-2014-3743 describes multiple cross-site scripting (XSS) vulnerabilities in the Marked module for Node.js prior to version 0.3.1. The flaws exist in the handling of GFM (GitHub Flavored Markdown) codeblocks and javascript URLs, allowing injection of arbitrary web script or HTML.

Exploitation

Attackers can exploit these vulnerabilities by crafting markdown input that includes malicious code in the language field of GFM codeblocks or in javascript URLs. When the markdown is rendered by the Marked module, the injected script executes in the context of the user's browser. No authentication is required if the application accepts user-supplied markdown.

Impact

Successful exploitation permits the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, defacement, or other malicious actions.

Mitigation

Users are advised to upgrade to Marked version 0.3.1 or later, which includes patches for these XSS vectors. No workarounds are known.