XSS in SmartClient error message

[dhoch]

SmartClient Version: v12.1p_2022-12-31/LGPL Development Only (built 2022-12-31)
Browser: Chrome


Hi,

I received a report from a recent pentest. They were able to execute an XSS attack against our site.

Here's the URL the testers were able to inject. Note that the call to example.com was blocked, but the error handler was invoked after being displayed in the error message.

https://www.example.com/?<img src=x onerror=alert(1)>

The screenshot below shows that the error message isn't being HTML Encoded. We already have a fix on our side, but I thought I'd bring it to Isomorphic's attention.



Thanks!

[Isomorphic]

This not a SmartClient XSS exploit, this is an application-specific XSS error.

Specifically, that is a client-side error message, not coming from the server. So it requires first that you have somehow allowed some untrusted users to store unsanitized URLs that are automatically used in attempted fetches by other users.

That’s the error - sharing unsanitized URL between users - not the fact that as a distant consequence, SmartClient’s error handling will display the unsanitized URL.

[dhoch]

Hi, and thanks for the response!

I think you are spot on with your assessment. Our fix was to sanitize the URLs. I just thought you might want to HTML encode any error messages before displaying.

Thanks!