Listen to this Post
The vulnerability resides in the `vlSelectionTuples` function. Vega’s expression evaluator normally restricts arbitrary function calls. However, when an event object is exposed to an expression, property access on `window` objects becomes possible. An attacker can craft a Vega JSON specification where a signal’s `update` expression passes a malicious object to vlSelectionTuples. This object sets its `map` property to a function gadget found in the global scope, such as VEGA_DEBUG.vega.CanvasHandler.prototype.on. When `vlSelectionTuples` processes this object, it calls the user-controlled `map` function. The malicious `map` function (the gadget) is designed to chain calls: `this.eventName` (set to console.log) is called, returning undefined. This result indexes into this._handlers, which is an object keyed with `undefined` containing an XSS payload string. Finally, `this._handlerIndex` (set to window.eval) is invoked with this string as an argument, executing the arbitrary JavaScript in the victim’s browser context, leading to DOM XSS.
Platform: Vega
Version: v5, v6
Vulnerability : DOM XSS
Severity: Critical
date: 2024-12-01
Prediction: 2024-12-15
What Undercode Say:
Check if vega-selections is vulnerable npm list vega-selections Update to the patched version for Vega v5 npm install [email protected] Update to the patched version for Vega v6 (ESM) npm install [email protected]
{
"update": "vlSelectionTuples({
map: event.view.VEGA_DEBUG.vega.CanvasHandler.prototype.on,
eventName: event.view.console.log,
_handlers: {
undefined: 'alert(document.domain)'
},
_handlerIndex: event.view.eval
})"
}
How Exploit:
Attacker crafts malicious Vega JSON spec with a signal that calls `vlSelectionTuples` with a poisoned object. The object uses global function gadgets to chain a call to window.eval. User loads spec, triggers event (e.g., mousemove). Gadget executes, leading to arbitrary script execution.
Protection from this CVE:
Apply library patches. Avoid attaching vega/vega.View to window. Validate/sanitize user-provided Vega JSON. Use Content Security Policy.
Impact:
Arbitrary JavaScript execution. Theft of authentication tokens/session data. Data manipulation. Unauthorized actions on victim’s behalf.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
