Listen to this Post
The vulnerability is a Cross-Site Scripting (XSS) flaw in Spotipy’s OAuth callback server. During OAuth authentication, Spotipy initiates a local HTTP server to handle callbacks. This server unsafely reflects the ‘error’ URL parameter into its HTML response without sanitization. The vulnerable code resides in spotipy/oauth2.py within the RequestHandler.do_GET method. Specifically, at line 1255, a status message is constructed using ‘self.server.error’, which contains the raw, unescaped error parameter from the URL. This status string is then directly embedded into an HTML template at line 1265. The error parameter is parsed from the incoming request query string in lines 388-393, allowing an attacker to inject arbitrary JavaScript code. When a user is in the OAuth flow and the local server is active, an attacker can craft a malicious URL with a script payload in the error parameter. If the user visits this URL, the injected JavaScript executes within the localhost origin in the user’s browser. This attack requires precise timing to coincide with the OAuth window and relies on user interaction, such as clicking a link. The localhost confinement limits some attack vectors but still permits actions like accessing other local services, stealing data from local web apps, or extracting OAuth tokens. The Proof of Concept demonstrates this by starting the server and sending a request with a simple script tag, showing the payload reflected unchanged in the HTML.
Platform: Spotipy
Version: All versions
Vulnerability: Cross-Site Scripting
Severity: Medium
Date: Unknown
Prediction: No patch date
What Undercode Say:
Analytics
pip install spotipy requests python3 poc_xss.py
!/usr/bin/env python3
import requests
from spotipy.oauth2 import start_local_http_server
import threading
import time
def start_server():
server = start_local_http_server(8080)
server.handle_request()
thread = threading.Thread(target=start_server, daemon=True)
thread.start()
time.sleep(2)
payload = '<script>alert("XSS")</script>'
url = f'http://127.0.0.1:8080/?error={payload}&state=test'
response = requests.get(url)
print(response.text)
if payload in response.text:
print("VULNERABLE")
How Exploit:
Craft malicious URL with script in error parameter. Trigger during OAuth callback window. User visits URL, JavaScript executes.
Protection from this CVE
Apply HTML escaping to error parameter. Use html.escape() in status construction.
Impact:
Execute JavaScript locally. Access localhost services. Steal OAuth tokens. Bypass CSRF protections.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
