Listen to this Post
The vulnerability exists within Vega’s internal `modify()` expression function, which is accessible through user-controlled specifications, notably via the `setdata` operation. This function is not part of the public API but is exposed in the expression context. An attacker can craft a malicious Vega specification where they control both the target object and the arguments passed to modify(). By specifying a dangerous native function (like alert) as an argument, the attacker can redirect the `modify()` call to execute this function within the application’s context. The provided Proof of Concept demonstrates this by using `event.dataflow._el.ownerDocument.defaultView.alert` as the method parameter, effectively allowing the execution of arbitrary JavaScript when the specification is parsed and evaluated by Vega, leading to Cross-Site Scripting.
Platform: Vega
Version: < 6.1.1
Vulnerability: XSS via modify()
Severity: Critical
Date: 2024-12-10
Prediction: 2024-12-17
What Undercode Say:
`npm list vega-functions`
`curl -s https://vega.github.io/editor/ | grep version`
`{“update”: “modify(‘table’, ‘push’, 1, event.dataflow._el.ownerDocument.defaultView.eval, ‘alert(1)’)”}`
How Exploit:
1. Attacker crafts Vega JSON spec.
2. Embeds malicious `modify()` call.
3. Spec loaded by vulnerable app.
4. `modify()` executes attacker’s function.
5. Arbitrary JS runs (XSS).
Protection from this CVE
Upgrade to vega-functions>=6.1.1.
Implement strict Content Security Policy.
Sanitize user-supplied Vega specs.
Impact:
Cross-Site Scripting.
Session hijacking.
Data theft.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
