Full Report
The author of this post noticed a new piece of functionality in Github: LaTeX support. This support was given in Markdown through the library MathJax. Since the combining of many different libraries is very complicated to do, the author decided to take a look around at it. A valid macro looks like $$macro{}$$. First, they noticed that the tag $$\HELLO{}$$ went through. But, this ONLY happens with a leading slash after the $$ for the math operator being declared. Although, this didn't allow for any crazy tags besides tags. This led to them being able to add many different style expressions such as changing the background of the page. Unfortunately, this was closed as a duplicate almost immediately. Within the math expressions though, there was still a lack of input validation. Simply putting $$Test{}$$ would render a div. Similar payloads could be used for input forms as well. Using a payload in here could AGAIN be used to change the CSS on the page to do malicious things. But, the author had jumped the gun as the fixing of the first issue fixed this issue as well. Third times the charm, as they say. The original payload of putting the tags after the slash (\) wasn't working anymore; anything put in there was simply filtered out. However, now tags within the curly braces were being rendered ONLY when the ones with the backslash were being filtered out. $$\{<renderTag>}$$ is a working payload demonstrating this. This appears like some code was exiting earlier than it should have. Only some of the tags were rendering though. Eventually, they went with the payload containing an input tag for a fake login screen to send the credentials to the user. Still, no XSS from this but still quite a bit of impact. Github accepted this as a medium severity finding and paid out 10K for the issue. Overall, good post on methodology of XSS hunting and target finding.
Analysis Summary
# Vulnerability: HTML Injection via GitHub MathJax Markdown Integration
## CVE Details
- **CVE ID**: Not explicitly assigned (GitHub-specific vulnerability)
- **CVSS Score**: Medium Severity (Estimated 4.3 - 6.1 range based on payout)
- **CWE**: CWE-79 (Improper Neutralization of Input During Web Page Generation) / CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page)
## Affected Systems
- **Products**: GitHub.com
- **Versions**: Production instances prior to October 2022
- **Configurations**: Markdown rendering engines supporting the MathJax library for LaTeX mathematical expressions.
## Vulnerability Description
The vulnerability stems from an incomplete filtration bypass in GitHub's LaTeX rendering implementation. GitHub utilized the MathJax library to render mathematical expressions delimited by `$$`.
The core flaw resided in how the parser handled backslashes (`\`) and curly braces (`{}`). While GitHub attempted to filter advanced HTML tags, the researcher discovered that placing tags within a specific macro-like structure—specifically when a backslash was followed by filtered content—caused the parser to exit early or fail to sanitize content within the subsequent curly braces. This allowed arbitrary HTML tags (such as `<input>`) to be injected into the DOM within the MathJax container.
## Exploitation
- **Status**: PoC available; reported and patched via Bug Bounty program.
- **Complexity**: Medium
- **Attack Vector**: Network (Web-based Markdown injection)
## Impact
- **Confidentiality**: Medium (Ability to facilitate credential theft via fake login forms)
- **Integrity**: Medium (Ability to alter page CSS or inject unauthorized UI elements)
- **Availability**: None
## Remediation
### Patches
- **GitHub Production Update**: GitHub has patched the MathJax integration to properly sanitize all inputs within the mathematical delimiters. Users do not need to take action for the cloud-based platform.
### Workarounds
- No manual workarounds are required for GitHub.com users. For users of self-hosted GitHub Enterprise Server (GHES), ensure the latest security patches are applied to update the Markdown rendering engine.
## Detection
- **Indicators of Compromise**: Presence of Markdown files containing LaTeX macros with embedded HTML entities or tags, such as:
- `$$\{<input...>}$$`
- `$$\\HELLO{}$$`
- **Detection methods and tools**: Web Application Firewalls (WAF) can be configured to inspect mathematical delimiters (`$$ ... $$`) for encoded HTML characters or unconventional CSS/JS properties.
## References
- **Vendor Advisory**: GitHub Bug Bounty Program (HackerOne)
- **Original Write-up**: hxxps[://]infosecwriteups[.]com/how-i-got-10-000-from-github-for-bypassing-filtration-of-html-tags-db31173c8b37
- **Library Website**: hxxps[://]www[.]mathjax[.]org/