Lab 76 — DocuWeave — Stored XSS via Diagram Rendering Attribute Injection

hackadvisor

Task: DocuWeave wiki platform (Express + marked) renders markdown article bodies server-side with no sanitization and no CSP; an admin bot opens reported articles. Solution: stored XSS via raw <img onerror> in markdown body, triggered by the report endpoint, exfiltrating the admin's non-HttpOnly flag cookie same-origin to a comment thread.