| Название | michaelliao itranswarp 2.19 xss |
|---|
| Описание | # Authenticated Stored Cross-Site Scripting in itranswarp
## Summary
itranswarp contains a stored Cross-Site Scripting (XSS) vulnerability in the rendering of article, wiki, and single-page content.
An authenticated user with the `CONTRIBUTOR` role can create an article containing attacker-controlled raw HTML. The application processes the content through `Markdown.toHtml()` without enabling HTML escaping or applying an HTML sanitizer. The resulting HTML is subsequently rendered by Thymeleaf templates using the `|raw` expression, allowing attacker-controlled JavaScript to be executed in the browser of any user who views the affected content.
The vulnerability can be triggered by unauthenticated users accessing the affected article/page. Therefore, an attacker with `CONTRIBUTOR` privileges can persist malicious JavaScript that executes in the security context of the itranswarp application for other users, including administrators.
## Affected Product
* **Product:** itranswarp
* **Repository:** https://github.com/michaelliao/itranswarp
* **Affected Component:** Article / Wiki / Single Page content rendering
* **Vulnerability Type:** Stored Cross-Site Scripting (XSS)
* **CWE:** CWE-79 — Improper Neutralization of Input During Web Page Generation
## Affected Version
* `<insert affected version>`
The vulnerability was verified against the affected version listed above.
## Prerequisites
An attacker must be authenticated with at least the `CONTRIBUTOR` role.
No authentication or elevated privileges are required for a victim to trigger the vulnerability. The victim only needs to access the affected article, wiki page, or single page.
## Vulnerability Details
The vulnerability is caused by the combination of insufficient input validation, unsafe Markdown rendering, and raw HTML output in the application templates.
### 1. Attacker-controlled content can be submitted
The application exposes the following endpoint for creating articles:
```text
POST /api/articles
```
The endpoint requires the `CONTRIBUTOR` role.
Relevant code:
```text
ApiController.java:263-270
```
The submitted content is passed through `checkContent()`.
`checkContent()` only checks whether the content is null, empty, or exceeds the maximum allowed length. It does not perform HTML escaping or HTML sanitization.
Relevant code:
```text
AbstractRequestBean.java:68-70
AbstractRequestBean.java:129-141
```
Consequently, attacker-controlled HTML can be stored as part of the article content.
### 2. Markdown rendering does not escape HTML
The stored content is processed by `Markdown.toHtml()`.
The Markdown renderer uses the `sysRenderer` configuration without enabling HTML escaping:
```text
Markdown.java:63
Markdown.java:95-98
```
In particular, the renderer does not enable:
```text
escapeHtml(true)
```
Therefore, raw HTML blocks and inline HTML contained in Markdown content are preserved by the renderer.
### 3. Stored content is rendered to users
When a user accesses an article, the application retrieves the rendered content through:
```text
GET /article/{id}
```
The relevant execution path is:
```text
MvcController.java:228-235
|
v
TextService.getHtmlFromCache()
|
v
Markdown.toHtml()
```
Relevant source locations:
```text
MvcController.java:228-235
TextService.java:46-54
```
The same rendering mechanism is also used for wiki and single-page content.
### 4. Rendered HTML is inserted into the response without escaping
The final rendered content is inserted into Thymeleaf templates using the `|raw` expression:
```text
article.html:68
wiki.html:256
single.html:32
```
The relevant template expression is:
```text
{{ content|raw }}
```
This causes the previously rendered attacker-controlled HTML to be inserted into the resulting HTML response without further output encoding.
The complete data flow is therefore:
```text
Authenticated CONTRIBUTOR
|
| POST /api/articles
v
checkContent()
|
| No HTML sanitization
v
Stored article content
|
v
TextService.getHtmlFromCache()
|
v
Markdown.toHtml()
|
| HTML escaping disabled
v
Rendered attacker-controlled HTML
|
v
content|raw
|
v
Victim's browser
|
v
JavaScript execution
```
## Proof of Concept
The following payload was used to verify the vulnerability:
```html
<img src=x onerror=alert(document.domain)>
```
### Reproduction Steps
1. Authenticate to itranswarp using an account with the `CONTRIBUTOR` role.
2. Create an article through:
```text
POST /api/articles
```
3. Set the article content to:
```html
<img src=x onerror=alert(document.domain)>
```
4. Submit the article successfully.
5. Access the resulting article through:
```text
GET /article/{id}
```
6. The payload is rendered as HTML rather than displayed as text.
7. The browser executes the JavaScript event handler.
The vulnerability was verified in a local itranswarp deployment. The proof-of-concept caused the browser to display:
```text
localhost
```
through `alert(document.domain)`.
The same underlying rendering issue affects the following content types:
* Articles
* Wiki pages
* Single pages
## Impact
Successful exploitation allows a `CONTRIBUTOR`-level attacker to persist arbitrary client-side JavaScript in application content.
Any user who subsequently accesses the affected content can be targeted, including users with administrative privileges.
Depending on the victim's privileges and the application's available functionality, successful exploitation may allow an attacker to:
* execute arbitrary JavaScript in the security context of the itranswarp application;
* perform authenticated actions on behalf of the victim;
* access information exposed to JavaScript within the application's origin;
* modify application-visible content;
* target administrator accounts and privileged users.
The vulnerability is particularly significant because the attacker does not need to interact directly with the victim. Once malicious content has been stored, any user who views the affected content can trigger the payload.
## Security Properties
| Property | Value |
| ----------------------- | ---------------------------------------------- |
| Attack Vector | Network |
| Attacker Authentication | Required |
| Required Attacker Role | `CONTRIBUTOR` |
| Victim Authentication | Not required |
| User Interaction | Required — victim must access affected content |
| Persistence | Yes |
| Affected Content | Article / Wiki / Single Page |
| Vulnerability Type | Stored XSS |
## Root Cause
The root cause is the absence of a security boundary between untrusted user-controlled Markdown content and the final HTML rendering context.
The application currently relies on:
1. `checkContent()` for basic content validation;
2. Markdown rendering through `Markdown.toHtml()`;
3. raw HTML output through the `content|raw` template expression.
None of these stages provides an effective HTML sanitization boundary.
In particular, the Markdown renderer does not enable HTML escaping, while the final template explicitly renders the resulting content as raw HTML.
## Remediation
The application should establish a clear sanitization boundary before untrusted content reaches an HTML rendering context.
Recommended approaches include:
### Option 1 — Disable raw HTML
Enable HTML escaping in the Markdown renderer:
```text
escapeHtml(true)
```
This is the simplest solution when raw HTML is not a required application feature.
### Option 2 — Sanitize HTML
If itranswarp intentionally supports raw HTML inside Markdown content, HTML should not simply be escaped because doing so would break the intended rendering functionality.
Instead, the application should sanitize the generated HTML using a well-maintained HTML sanitization library, such as:
* OWASP Java HTML Sanitizer
* jsoup with an appropriate Safelist
The sanitized result can then be safely rendered.
### Option 3 — Avoid unconditional raw output
The use of:
```text
content|raw
```
should not be treated as a security boundary.
Removing `|raw` alone may prevent HTML interpretation, but if HTML content is an intentional feature, this should be combined with a proper HTML sanitizer rather than simply displaying the HTML source to users.
## References
https://github.com/michaelliao/itranswarp/issues/74
|
|---|
| Источник | ⚠️ https://github.com/michaelliao/itranswarp/issues/74 |
|---|
| Пользователь | mjh_123 (UID 92618) |
|---|
| Представление | 12.08.2026 05:34 (1 месяц назад) |
|---|
| Модерация | 13.09.2026 21:23 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 403334 [michaelliao itranswarp до 2.19 Page Content Rendering Markdown.java Markdown.toHtml межсайтовый скриптинг] |
|---|
| Баллы | 20 |
|---|