Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-11055

CVE-2020-11055: Cross-Site Scripting in BookStack

6.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-11055
GHSA ID
GHSA-5vf7-q87h-pg6w
EPSS Score
0.59401%
CWE
CWE-79
Published
5/7/2020
Updated
1/9/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
ssddanbrown/bookstackcomposer>= 0.18.0, < 0.29.20.29.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unsanitized HTML being stored in comments. The primary entry point would be the comment creation endpoint (CommentController@store) which processes POST data. The model layer (Comment::newFromInput) would be responsible for persisting this data. Runtime detection would show these functions handling raw user input during exploitation. The patch likely added HTML purification in these methods and introduced output escaping in views, though view functions aren't explicitly mentioned in available data.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t * us*r wit* p*rmission to *r**t* *omm*nts *oul* POST *TML *ir**tly to t** syst*m to ** s*v** in * *omm*nt, w*i** woul* t**n ** *x**ut**/*ispl*y** to ot**rs us*rs vi*win* t** *omm*nt. T*rou** t*is vuln*r**ility *ustom J*v*S*ript *o** *oul*

Reasoning

T** vuln*r**ility st*ms *rom uns*nitiz** *TML **in* stor** in *omm*nts. T** prim*ry *ntry point woul* ** t** *omm*nt *r**tion *n*point (`*omm*nt*ontroll*r@stor*`) w*i** pro**ss*s POST **t*. T** mo**l l*y*r (`*omm*nt::n*w*romInput`) woul* ** r*sponsi*