Listen to this Post
The vulnerability occurs when attacker-controlled input is passed directly to the `ui.navigate.history.push()` or `replace()` functions. These functions are wrappers for the browser’s History API, designed to update the URL without reloading the page. Internally, NiceGUI generates JavaScript code that includes the provided URL argument as a string literal. If this input contains characters like quotes ("), parentheses ()), or semicolons (;), an attacker can break out of the string context in the generated JavaScript. For example, a payload like `”);alert(document.domain);//` would close the string and function call, then execute arbitrary JavaScript. This leads to DOM-based Cross-Site Scripting (XSS) because the unsanitized input from the client (e.g., URL path parameters) is reflected back into the executed script on the client side, compromising users who interact with the vulnerable NiceGUI application.
Platform: NiceGUI
Version: Not specified
Vulnerability: DOM-based XSS
Severity: Medium
Date: Not specified
Prediction: Patch expected soon
What Undercode Say:
Example vulnerable code pattern in a NiceGUI app ui.navigate.history.push(user_controlled_input) PoC payload to test for vulnerability payload = '");alert(document.domain);//'
How Exploit:
Attacker crafts a malicious URL containing JavaScript payload. Victim visits the attacker’s link or a page that embeds the poisoned parameter. The vulnerable app passes the payload to history.push(), executing the script in the victim’s browser.
Protection from this CVE
Sanitize all user inputs. Use built-in URL encoding. Avoid passing untrusted data to `ui.navigate.history` methods. Update NiceGUI upon patch release.
Impact:
Client-side code execution. Session hijacking. Phishing attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
