CVE-2023-25572: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
(updated )
react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and 4.7.6, along with ra-ui-materialui prior to 3.19.12 and 4.7.6, is vulnerable to cross-site scripting. All React applications built with react-admin and using the <RichTextField> are affected. <RichTextField> outputs the field value using dangerouslySetInnerHTML without client-side sanitization. If the data isn’t sanitized server-side, this opens a possible cross-site scripting (XSS) attack. Versions 3.19.12 and 4.7.6 now use DOMPurify to escape the HTML before outputting it with React and dangerouslySetInnerHTML. Users who already sanitize HTML data server-side do not need to upgrade. As a workaround, users may replace the <RichTextField> by a custom field doing sanitization by hand.
References
- github.com/advisories/GHSA-5jcr-82fh-339v
- github.com/marmelab/react-admin/pull/8644
- github.com/marmelab/react-admin/pull/8645
- github.com/marmelab/react-admin/releases/tag/v3.19.12
- github.com/marmelab/react-admin/releases/tag/v4.7.6
- github.com/marmelab/react-admin/security/advisories/GHSA-5jcr-82fh-339v
- nvd.nist.gov/vuln/detail/CVE-2023-25572
Code Behaviors & Features
Detect and mitigate CVE-2023-25572 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →