Executive brief
The public npm package is a file/folder browser utility that renders directory listings in the browser. A reflected XSS vulnerability allows attackers to inject malicious JavaScript through unsanitized file or folder names, potentially stealing user credentials or hijacking sessions when a victim visits a crafted URL.
Technical details
This is a reflected XSS (CWE-79) vulnerability in the public npm module versions before 0.1.4, caused by insufficient input sanitization of file and folder names before rendering them in HTML. An attacker can craft a URL with malicious JavaScript embedded in a filename parameter, which executes in the browser of any user who visits the link without proper encoding/escaping. The attack requires user interaction (clicking a malicious link) and network access. Exploitation allows arbitrary JavaScript execution in the victim's browser context. The vulnerability was patched in version 0.1.4.
Affected products
- Tnantoka public <0.1.4
Timeline
- 2019-02-07: disclosed
- 2019: patched: Fixed in version 0.1.4