Executive brief
generator-hottowel is a Yeoman generator for scaffolding web applications. A reflected cross-site scripting (XSS) vulnerability exists in the 404 error handler that allows attackers to inject malicious JavaScript code into user browsers via crafted URLs. An attacker could steal session tokens, redirect users to phishing sites, or perform unauthorized actions on behalf of affected users.
Technical details
The vulnerability is a reflected XSS (CWE-79) in the 404 error handler component located in app/templates/src/server/_app.js. The vulnerable code fails to sanitize user-supplied URL parameters before echoing them in the HTTP response, allowing an attacker to inject arbitrary JavaScript. The attack is network-accessible and requires only user interaction (clicking a malicious link); no authentication is required. An attacker can craft a URL with JavaScript payload (e.g., GET /images/?41b68(a)184a9=1) that gets reflected unmodified in the application response, executing in the victim's browser context. The fix (commit c17092fd4103143a9ddab93c8983ace8bf174396, released in version 0.5.0) replaces the default Express 404 response with a custom response object that properly sanitizes input.
Affected products
- John Papa generator-hottowel before 0.5.0
Timeline
- 2023-02-20: disclosed: Vulnerability disclosed in GitHub Advisory Database
- 2023-02-20: advisory: GHSA-f8hv-rx9p-f9r4 published
- 2017-02-27: patched: Fix merged in PR #174; patch released in version 0.5.0