https://huntr.dev/users/mufeedvh has fixed the Cross-site Scripting (XSS) vulnerability π¨. mufeedvh has been awarded $25 for fixing the vulnerability through the huntr bug bounty program π΅. Think you could fix a vulnerability like this?
The project x-editable validated JSON string with poorly crafted Regex making it easy to bypass the validation and inject JavaScript code to achieve XSS (Cross-site Scripting).
π» Technical Description *
The implemented Regex to validate JSON was so poor that it only checks whether if the string begins and ends with [ or { and their counterparts ] or }. This means you can give it a string such as []+alert(1)+[] and it will match.
Come on man why would you write a whole Regex to validate JSON semantics lol, and JavaScript's Regex match doesn't have certain expressions implemented making it even harder.
So how do we fix it? Just parse the JSON with the JavaScript function JSON.parse() and if it fails, it's not a valid JSON string.
Parse the input JSON string and if it fails, it wouldn't proceed dynamically adding it to the HTML code preventing the XSS (Cross-site Scripting) vulnerability.
if (typeof s === 'string' && s.length) {
try {
JSON.parse(s);
if (safe) {
try {
/*jslint evil: true*/
s = (new Function('return ' + s))();
/*jslint evil: false*/
} catch (e) {} finally {
return s;
}
} else {
/*jslint evil: true*/
s = (new Function('return ' + s))();
/*jslint evil: false*/
}
return s;
} catch (e) {
// pass
}
}
π User Acceptance Testing (UAT)
Just added a try/catch block to check for JSON.parse() fails.
https://huntr.dev/users/mufeedvh has fixed the Cross-site Scripting (XSS) vulnerability π¨. mufeedvh has been awarded $25 for fixing the vulnerability through the huntr bug bounty program π΅. Think you could fix a vulnerability like this?
Get involved at https://huntr.dev/
Q | A Version Affected | ALL Bug Fix | YES Original Pull Request | https://github.com/418sec/x-editable/pull/1 GitHub Issue | https://github.com/vitalets/x-editable/issues/1130 Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/npm/x-editable/1/README.md
User Comments:
π Metadata *
Bounty URL: https://www.huntr.dev/bounties/1-npm-x-editable
βοΈ Description *
The project
x-editable
validated JSON string with poorly crafted Regex making it easy to bypass the validation and inject JavaScript code to achieve XSS (Cross-site Scripting).π» Technical Description *
The implemented Regex to validate JSON was so poor that it only checks whether if the string begins and ends with
[
or{
and their counterparts]
or}
. This means you can give it a string such as[]+alert(1)+[]
and it will match.Come on man why would you write a whole Regex to validate JSON semantics lol, and JavaScript's Regex match doesn't have certain expressions implemented making it even harder.
So how do we fix it? Just parse the JSON with the JavaScript function
JSON.parse()
and if it fails, it's not a valid JSON string.π Proof of Concept (PoC) *
Refer: https://github.com/vitalets/x-editable/issues/1130
Payload used to bypass the current validation:
π₯ Proof of Fix (PoF) *
Parse the input
JSON
string and if it fails, it wouldn't proceed dynamically adding it to the HTML code preventing the XSS (Cross-site Scripting) vulnerability.π User Acceptance Testing (UAT)
Just added a
try/catch
block to check forJSON.parse()
fails.