Executive brief
console-feed is a JavaScript library that captures and displays console output in web applications. Versions prior to 2.8.10 fail to properly escape HTML, allowing attackers to inject malicious scripts through console.log() calls. This could enable session hijacking, credential theft, or defacement if the vulnerable library is used in a web app.
Technical details
The vulnerability is a stored or reflected cross-site scripting (XSS) flaw in console-feed's output rendering. When a malicious JavaScript payload is passed to console.log() with format specifiers (e.g., console.log('%_', payload)), the library renders HTML containing the unescaped payload, allowing arbitrary script execution in the browser context. The attack requires the application to use console-feed and expose console output to the DOM. The vulnerability was fixed in version 2.8.10 by properly escaping rendered output.
Affected products
- console-feed console-feed prior to 2.8.10
Timeline
- 2020-09-03: disclosed