CVE-2022-2514: Reflected XSS in Fava
CVE ID: CVE-2022-2514
Date: July 25, 2022
Severity: Medium (CVSS 3.1: 6.1)
CWE: CWE-79 — Improper Neutralization of Input During Web Page Generation
Affected: Fava (beancount/fava) prior to v1.22
Fixed in: v1.22
🔍 Overview
The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting (XSS). Error messages containing these parameters are reflected back to the user without proper escaping, allowing an attacker to craft a malicious URL that executes JavaScript in the victim’s browser.
CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector: Network, low complexity, no privileges required, user interaction required, changed scope.
🎯 Impact
An attacker crafts a URL with a malicious time or filter parameter and tricks a victim into clicking it. When the victim visits the URL, the injected script executes in their browser within the context of the Fava application, potentially leading to:
- Session hijacking
- Credential theft
- Unauthorized actions within Fava
🛡️ Mitigation
Upgrade to Fava v1.22 or later. Ensure all user-supplied query parameters are properly HTML-escaped before being reflected in error messages or page content.