SB2026080118 - Multiple vulnerabilities in Shaarli

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear

The vulnerability allows a remote user to execute arbitrary JavaScript in the victim's browser.

The vulnerability exists due to cross-site scripting in the general.header_link configuration setting rendered by the page header template when handling a stored home link value in the title link href. A remote privileged user can store a javascript: URI in the configuration to execute arbitrary JavaScript in the victim's browser.

User interaction is required, as a visitor must click the title or logo link for the payload to execute.

2) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to disclose sensitive information from internal HTTP services.

The vulnerability exists due to server-side request forgery (SSRF) in the /admin/metadata endpoint when fetching a user-supplied URL server-side via cURL. A remote privileged user can send a specially crafted request to disclose sensitive information from internal HTTP services.

Redirects are followed automatically without revalidating the destination, and the JSON response returns the fetched page title and meta description data.

Remediation

Install update from vendor's website.

References

• https://github.com/shaarli/Shaarli/security/advisories/GHSA-rvrg-mx59-mv8x
• https://github.com/shaarli/Shaarli/security/advisories/GHSA-85jx-fhrf-q9w7