CVE-2024-21535

Vulnerability

Versions of the package markdown-to-jsx prior to 7.4.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of the src property in iframe elements [1][2][3]. The library's markdown parser allows arbitrary HTML elements, and when processing a malicious markdown string containing an iframe, the src attribute is not properly escaped or validated [1][3]. This permits an attacker to embed a JavaScript payload within the src attribute (e.g., javascript:alert()) that executes in the context of the user's browser [3].

Exploitation

An attacker can craft a markdown document containing an ` tag. If the application renders user-supplied markdown using the vulnerable library, the malicious iframe is injected into the DOM and the JavaScript payload is executed. No special authentication or network position is required beyond the ability to supply markdown content to the application [3]. A proof-of-concept demonstrates the vulnerability with a simple React component rendering the markdown string ` [3].

Impact

Successful exploitation leads to arbitrary JavaScript execution in the victim's browser session. This can result in session hijacking, data theft, defacement, or other actions typical of stored or reflected XSS attacks [2][3]. The vulnerability is classified with a CVSS score indicating medium to high severity, as it allows client-side code execution without user interaction beyond viewing the content.

Mitigation

The vulnerability is fixed in version 7.4.0 of markdown-to-jsx [3]. The fix ensures that the src attribute of iframes is sanitized before rendering [4]. Users should upgrade to version 7.4.0 or later. No known workarounds are documented; disabling HTML iframe rendering or applying an external sanitizer may mitigate the risk but are not official recommendations.