CVE-2018-12104

Vulnerability

Airbnb Knowledge Repo version 0.7.4 contains a stored cross-site scripting (XSS) vulnerability in the post comments functionality [1][4]. An attacker can inject arbitrary JavaScript or HTML into the comment field, which is then rendered without proper sanitization when the post is viewed. The vulnerable endpoint is /post/posts/new_report.kp [1]. The issue is caused by insufficient output encoding of user-supplied input in the comment submission and display pipeline.

Exploitation

An attacker does not need authentication; the post comments feature is accessible to unauthenticated users on public posts [4]. The attack requires only that a victim views the post containing the malicious comment. The attacker submits a comment containing a payload such as `` [4]. When any user (including an authenticated user or administrator) views the post, the payload executes in their browser context.

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the victim's session on the Knowledge Repo instance [4]. The attacker can perform a wide range of client-side attacks, including session hijacking, defacement, phishing, redirection to malicious sites, or browser-based cryptomining [4]. The attacker does not gain server-side access, but can compromise the integrity and confidentiality of the victim's interactions with the application.

Mitigation

As of the available references, no patched version has been released that addresses this vulnerability [3][4]. The project maintainers were notified via a GitHub issue [4]. Users should apply general web application security best practices, such as implementing context-sensitive output encoding and input validation, as recommended by the OWASP XSS Prevention Cheat Sheet [4]. If not already done, consider disabling anonymous comments or using a web application firewall (WAF) to filter malicious inputs until a fix is available.