Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction

Vulnerability

Overview

CVE-2024-39311 is a stored cross-site scripting (XSS) vulnerability in Publify, a self-hosted web publishing platform built on Ruby on Rails [1]. The flaw resides in the redirect functionality, where a user with publisher-level privileges can create a redirect entry pointing to a javascript: URI (e.g., javascript:alert()) [3]. Although the redirect itself does not execute, an administrative panel renders this URI as an anchor (``) link [3].

Exploitation

Requirements

To exploit this vulnerability, an administrator must click the malicious link presented in the admin interface [1][3]. The attacker can encode or obscure the payload using HTML entities or other encodings to make the link appear legitimate [3]. This attack does not require any special network position; it is entirely dependent on social engineering of an administrator [1].

Impact

If successfully triggered, the XSS payload runs in the context of the administrator's session [3]. This enables a publisher—who typically has fewer privileges—to escalate their access and gain full administrative control over the Publify instance [1][3].

Mitigation

The issue is fixed in Publify version 10.0.1 and in the publify_core rubygem version 10.0.2 [1][3]. Administrators should upgrade immediately to prevent privilege escalation attacks from untrusted publishers.