Executive brief
oauth2orize-fprm is a Node.js library that handles OAuth 2.0 authorization via form-encoded responses. The library fails to properly sanitize crafted URLs, allowing attackers to inject malicious JavaScript code that executes in users' browsers. This could compromise user sessions, steal authentication tokens, or redirect users to phishing sites.
Technical details
A cross-site scripting (XSS) vulnerability exists in index.js of oauth2orize-fprm due to improper URL handling and output encoding. An attacker can craft a malicious URL containing unescaped JavaScript that is reflected back to the client without sanitization. The vulnerability requires user interaction (clicking a malicious link) and has network-accessible attack surface. No authentication is required. Exploitation allows arbitrary JavaScript execution in the context of the affected application. The vulnerability was fixed in version 0.2.1 through proper encoding of values in URL responses, as evidenced by commit 2bf9faee.
Affected products
- oauth2orize oauth2orize-fprm before 0.2.1
Timeline
- 2018-06-17: disclosed
- 2022-05-14: patched: Published to GHSA database; fix available in version 0.2.1