Summary

A stored Cross-Site Scripting (XSS) vulnerability exists in the Markdown-to-HTML conversion process used in the Bookmark Description field in Shaarli. An authenticated user can inject a malicious javascript: URI inside a Markdown link. The payload is converted to HTML without proper sanitization and executed when a user clicks the rendered link on the homepage.

Details

The vulnerability originates in the filterProtocols method within BookmarkMarkdownFormatter.php.

This method attempts to sanitize Markdown links by filtering dangerous protocols (such as javascript:) before rendering. It uses the following regular expression: (#]\((.*?)\)#is). This regex is designed to detect inline Markdown links.

However, it fails to detect Markdown reference-style links, Because reference-style links are resolved by the Markdown parser after preprocessing, the filterProtocols method never inspects the actual URL used in these references. As a result, an attacker can supply a javascript: URI inside a reference definition. When the Markdown parser converts this to HTML, it generates a valid <a> tag with a malicious href attribute:

PoC

Steps to reproduce:

1. Log in to Shaarli.
2. Add a new link (Shaare).
3. Set any valid URL.
4. Set the Description field to:

[Click Me for XSS][1]
[1]: javascript:alert('XSS_MARKDOWN')

5. Save the bookmark.
6. Navigate to the homepage.
7. Click the "Click Me for XSS" link.
8. Observe that the JavaScript payload executes immediately.

Impact

Impacted Users:

• Any user viewing bookmarks containing malicious Markdown descriptions
• Administrators and privileged users are also affected

Potential Consequences:

• Session hijacking
• Account takeover
• CSRF token theft
• Unauthorized actions performed on behalf of the victim
• Delivery of additional malicious client-side payloads

Because the vulnerability is stored and requires only a user click, it poses a significant risk in multi-user environments or shared instances.