CVE-2023-46127

Frappe HTML Injection in desk

• CVSS 5.4
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Input Validation and Sanitization
• Local

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0.

CVE

CVE-2023-46127

CWE

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

5.4

Published

2023-10-23

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update Frappe to version 14.49.0 or higher.

def save_user_input(user_input):
    """Vulnerable function that demonstrates the security issue."""
    
    document = {
        'content': user_input
    }

    database.save(document)

user_input = '<script>alert("XSS")</script><p>Code Executed.</p>'
save_user_input(user_input)

import html

def save_user_input(user_input):
    """Secure function that fixes the vulnerability."""
    sanitized_input = html.escape(user_input)

    document = {
        'content': sanitized_input
    }

    database.save(document)

user_input = '<script>alert("XSS")</script><p>Code Executed.</p>'
save_user_input(user_input)

@misc{vaitp:cve202346127,
  title        = {{Frappe HTML Injection in desk}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-46127},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-46127/}}
}