Anote 1.0 RCE via Persistent XSS (CVE-2021-47963)

title: CVE-2021-47963 - Anote Persistent XSS Markdown Injection
id: scw-2026-05-15-ai-1
status: experimental
level: high
description: |
  Detects the creation or modification of markdown files (.md) containing known or suspected persistent XSS payloads. This targets CVE-2021-47963, where attackers inject malicious JavaScript into markdown files to achieve RCE when the file is rendered by Anote 1.0.
author: SCW Feed Engine (AI-generated)
date: 2026-05-15
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2021-47963/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: file_event
detection:
  selection:
      TargetFilename|endswith:
          - '.md'
      # This is a placeholder for a specific malicious JavaScript pattern within markdown.
      # Real-world detection would require analyzing actual exploit payloads.
      # Example: Detecting a specific script tag or known XSS payload structure.
      # For demonstration, we'll use a hypothetical pattern.
  selection_payload:
      TargetFilename|contains:
          - '<script>alert(\'XSS\')</script>'
          - '<img src=x onerror=alert(1)>'
      condition: selection AND selection_payload
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse