Listen to this Post
When a CSS file is requested from esm.sh with the `?module` query parameter, the service converts it into a JavaScript module. The conversion process embeds the CSS content directly into a JavaScript template literal to create a stylesheet. The vulnerability exists because the sanitization logic is incomplete. The code checks if the CSS content contains a backtick (`); if it does, the content is safely JSON-encoded before insertion. However, if the CSS does not contain a backtick, the content is inserted directly into the template literal without escaping `${…}` syntax. This allows an attacker to craft a malicious CSS file containing a `${…}` template literal expression. When this malicious CSS module is imported by a victim’s application, the JavaScript code within the expression is executed in the context of the importer, leading to Cross-Site Scripting (XSS) in web browsers or Remote Code Execution (RCE) in environments like Electron.
Platform: esm.sh
Version: pre-patch
Vulnerability: Code Injection
Severity: Critical
date: 2024
Prediction: 2024-11-15
What Undercode Say:
curl "http://localhost:8080/[email protected]/evil.css?module"
// server/router.go lines 1112-1119
if bytes.ContainsRune(css, '<code>') {
buf.WriteString("stylesheet.replaceSync(</code>")
buf.WriteString(strings.TrimSpace(string(utils.MustEncodeJSON(string(css)))))
buf.WriteString(");\n")
} else {
buf.WriteString("stylesheet.replaceSync(<code>")
buf.Write(css) // VULNERABLE: Direct insertion
buf.WriteString("</code>);\n")
}
/ Malicious CSS /
${alert('XSS')}
How Exploit:
An attacker publishes a malicious package containing a CSS file with a template literal injection payload, such as ${alert(document.domain)}. When a victim application imports this CSS file via esm.sh using the `?module` parameter, the embedded JavaScript payload is executed.
Protection from this CVE:
Sanitize CSS input by escaping all `${` sequences to `\${` before inserting them into a template literal, regardless of whether backticks are present. Alternatively, consistently use JSON encoding for all CSS content.
Impact:
Arbitrary JavaScript code execution, leading to Cross-Site Scripting (XSS) in browser contexts and potential Remote Code Execution (RCE) in Electron-based desktop applications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
