Listen to this Post
The vulnerability exists in the ui.add_css, ui.add_scss, and `ui.add_sass` functions. These functions dynamically inject user-provided style content into the DOM via `client.run_javascript` or internal `add_head_html` methods. They fail to properly escape or sanitize input before placing it within dynamically generated `
` or </script>. This sequence prematurely terminates the intended HTML element, breaking out of the existing JavaScript string and HTML context. The content following the injected closing tag is then interpreted as raw HTML and JavaScript by the browser, leading to the execution of arbitrary attacker-controlled code in the context of the victim's session. The exploit is triggered when these functions are called with unsanitized user input, such as parameters from a URL.
Platform: NiceGUI
Version: ≤ 3.3.1
Vulnerability : DOM-based XSS
Severity: Moderate
Date: 2024-04-03
Prediction: Patch expected by 2024-04-24
What Undercode Say:
curl "http://target:8082/?color=red;}</style><script>alert('XSS')</script><style>"
Vulnerable Code Snippet ui.add_css(untrusted_user_input)
How Exploit:
Attacker crafts a malicious URL with `