decentraland/single-sign-on-client · Security
Improper Neutralization of Script in Attributes in @dcl/single-sign-on-client
- GHSA ID
- GHSA-vp4f-wxgw-7x8x
- CVE ID
- CVE-2023-41049
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Impact
Improper input validation in the init function allows arbitrary javascript to be executed using the javascript: prefix
SSO.init('javascript:alert("javascript successfully injected")')
Patches
This vulnerability was patched on version 0.1.0
Workarounds
This vulnerability can be prevented if user input correctly sanitized or there is no user input pass to the init function
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/decentraland/single-sign-on-client/security/advisories/GHSA-vp4f-wxgw-7x8x ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-41049 ↗
- https://github.com/decentraland/single-sign-on-client/pull/2 ↗
- https://github.com/decentraland/single-sign-on-client/commit/bd20ea9533d0cda30809d929db85b1b76cef855a ↗
- https://github.com/advisories/GHSA-vp4f-wxgw-7x8x ↗