md-fileserver: Stored/Reflected XSS when viewing Markdown (raw HTML allowed)

Vulnerability

Overview

The application's Markdown rendering logic contains a cross-site scripting (XSS) vulnerability because the markdown-it library is configured with html: true in config.js (lines 26–30), allowing raw HTML to pass through. The rendering function in lib/markd.js (lines 33–58) does not sanitize the output, and the resulting HTML is injected into the page template via <%= markdown %> without encoding [1][2]. This means any ` tags or event handlers (e.g., `) embedded in user-supplied Markdown are executed in the victim's browser.

Exploitation

An attacker can craft a Markdown file containing malicious HTML, such as a ` block that exfiltrates sensitive data. When a victim views or previews this Markdown, the script executes in the context of the affected domain. No special privileges are required beyond the ability to upload or share Markdown content; any user who can view the rendered output is a potential target [1][2]. The proof-of-concept demonstrates fetching /etc/passwd` with credentials and sending the result to an attacker-controlled server.

Impact

Successful exploitation allows arbitrary JavaScript execution, enabling session hijacking, account takeover, credential theft, defacement, and exfiltration of API tokens, CSRF tokens, or other sensitive data. All users who can view Markdown content within the application are affected [1][2].

Mitigation

As of the publication date, no patch has been announced. Mitigation requires disabling raw HTML in the Markdown renderer (setting html: false in the markdown-it configuration) or implementing a robust HTML sanitizer (e.g., DOMPurify) before rendering. Output encoding in the template should also be enforced [1][2].