CVE-2019-15532

Description

CyberChef versions prior to 8.31.2 contain a cross-site scripting (XSS) vulnerability in the TextEncodingBruteForce.mjs file [1][2]. The operation generates an HTML table of encoded values but fails to sanitize the output before inserting it into the DOM. Specifically, the Utils.printable function is called without escaping HTML entities, allowing attacker-controlled data to be interpreted as markup [4].

Exploitation

An attacker can exploit this vulnerability by crafting input that, when processed by the Text Encoding Brute Force operation, results in malicious HTML or JavaScript being injected into the page. The attack requires the victim to use the vulnerable operation on the crafted input. No authentication is needed if the attacker can trick a user into using the operation through social engineering or by persisting malicious content in a shared CyberChef instance [2].

Impact

Successful exploitation leads to arbitrary script execution in the context of the victim's browser. This could enable data theft, session hijacking, or further attacks within the CyberChef application [2]. Since CyberChef is often used in security contexts, an XSS attack could compromise sensitive data processed by the tool.

Mitigation

The vulnerability is fixed in CyberChef version 8.31.2 and later [4]. The fix ensures that values are HTML-escaped using Utils.escapeHtml before being inserted into the table [4]. Users should upgrade to the latest version. No workarounds are documented [2].