| Название | maliangnansheng NansBBS 3.0.0 Cross Site Scripting |
|---|
| Описание | NansBBS (Nan's BBS) 3.0.0 source at frontend commit 5c2662310c44b191e06686eb215971234fe65e5b and backend commit 3a4f626e6e8ad61110a0bd7dccc199570c1ec08c contains a stored cross-site scripting vulnerability in the article Markdown table of contents.
Any authenticated user can create an article and submit independently controlled markdown and html fields through multipart/form-data to POST /api/bbs/article/create; POST /api/bbs/article/update is limited to the author's own article. The backend persists html as ArticleMarkdownInfo.articleHtml in MongoDB without recomputing or sanitizing it. New or updated articles are placed in pending review.
GET /api/bbs/article/getById returns the stored html to the article author or a super-administrator before approval, and to anonymous readers after approval. ArticleDetail.vue renders the body from markdown but separately passes the stored html to utils.toToc(). The toToc string builder extracts headings and concatenates heading-derived identifiers into anchor class and href attributes without contextual encoding or an HTML sanitizer. MarkdownToc.vue then renders the generated directory string through Vue v-html.
A low-privileged author can therefore cause script execution in a different user's NansBBS same-origin browser context. A super-administrator may trigger it while opening a pending article from the review list; after approval, an anonymous or authenticated reader may trigger it by opening the public article. This is not self-XSS. An existing authorized test confirmed harmless cross-user execution; no executable payload is published.
The impact is limited here to script execution with access to data and actions available to the affected same-origin page. Cookie readability, CSP, and specific account consequences depend on deployment and are not claimed.
Affected files include bbs-article/bbs-article-service/src/main/java/com/liang/bbs/article/service/impl/ArticleServiceImpl.java, src/utils/utils.js, src/components/article/ArticleDetail.vue, and src/components/right/MarkdownToc.vue. The related open frontend PR #2 only changes comment rendering in ChildComment.vue and LatestComment.vue and does not cover this articleHtml-to-TOC root cause.
CWE-79. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4).
Vendor/product repository: https://github.com/maliangnansheng/bbs-springboot
Public vendor notification and technical evidence: https://github.com/maliangnansheng/bbs-springboot/issues/38 |
|---|
| Источник | ⚠️ https://github.com/maliangnansheng/bbs-springboot/issues/38 |
|---|
| Пользователь | JunRoinxxX (UID 100281) |
|---|
| Представление | 01.08.2026 09:02 (1 месяц назад) |
|---|
| Модерация | 12.09.2026 17:45 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 403148 [maliangnansheng bbs-springboot 3.0.0 ArticleController.java utils.toToc межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|