Listen to this Post
The vulnerability exists in the `createLink.openLink` function. This function accepts a base64-encoded URL, decodes it, and directly sets the decoded string as the `src` attribute of an iframe without validating the URL’s protocol. The critical flaw is the lack of a denylist or allowlist for protocols like javascript:. An attacker can provide a malicious base64-encoded string that decodes to a `javascript:` URL. When this URL is set as the iframe’s src, the JavaScript code within the URL executes in the context of the parent page’s origin, not a sandboxed iframe origin. This occurs because the `javascript:` protocol handler executes the code in the context of the page that owns the iframe element. The payload `javascript:alert(document.domain)//` is a valid URL that bypasses any simple checks for HTTP/HTTPS, leading to arbitrary code execution.
Platform: Mesh Web SDK
Version: pre-1.0
Vulnerability: DOM XSS
Severity: Critical
date: 2024-07-24
Prediction: Patch expected 2024-08-07
What Undercode Say:
echo "amF2YXNjcmlwdDphbGVydCgxKS8v" | base64 -d
// Vulnerable Code Snippet const decodedLink = atob(encodedLink); iframe.src = decodedLink; // Direct assignment without protocol validation
How Exploit:
Attacker crafts a malicious `javascript:` URL, base64 encodes it, and inputs it into the application. The `openLink` function decodes and sets it as an iframe’s src, executing the script in the parent’s context.
Protection from this CVE
Sanitize URL protocols by implementing an allowlist (e.g., only `http:` and https:). Use `URL` object for parsing and validation. Avoid setting `iframe.src` with unvalidated user input.
Impact:
Full parent page DOM access, session/cookie theft, potential wallet fund loss via transaction tampering if SDK used in financial context.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
