An attacker with the ability to edit content within the CMS can supply a javascript: pseudo-protocol URL. When a user clicks the resulting link on the published site, the malicious payload executes in the site's origin. This is particularly dangerous as it allows for the theft of sensitive data, such as local storage tokens (e.g., tinacms-auth), if the victim is an authenticated editor or administrator.

Attack Chain

1. Attacker gains access to the TinaCMS administrative interface to edit content fields.
2. Attacker modifies a rich-text field to include a hyperlink targeting a javascript: URI.
3. The CMS processes and stores the malicious AST representation of the rich-text.
4. The victim visits the public-facing webpage that utilizes the <tina-markdown> web component.
5. The component renders the malicious AST, creating an <a> element with the unvalidated javascript: payload in the href attribute.
6. The victim clicks the hyperlink.
7. The browser executes the JavaScript payload in the site's origin.
8. Attacker script exfiltrates sensitive browser data, such as localStorage authentication tokens.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of the vulnerable site's origin. Impacted sectors include any organization using TinaCMS for web content management. If an authenticated administrator or editor interacts with the malicious link, the attacker can hijack the session, exfiltrate sensitive local storage data, or perform unauthorized actions on behalf of the user, potentially leading to a full account takeover of the CMS instance.

Recommendation

1. Upgrade @tinacms/web-components to a patched version once available that implements URL scheme sanitization.
2. Until a patch is applied, implement a Content Security Policy (CSP) that restricts the usage of javascript: URIs in navigation and forbids inline script execution.
3. Utilize the existing sanitizeUrl utility from @tinacms/mdx/sanitize-url to manually sanitize node.url before assignment if patching the library source directly is required.
4. Review content stored in CMS rich-text fields for suspicious javascript: schemes.