Executive brief
html-pages is a Node.js package used to generate static HTML pages. The package does not properly sanitize folder names, allowing an attacker to craft malicious folder names containing JavaScript code that will execute in a user's browser when the generated pages are viewed. This can lead to session hijacking, credential theft, or malware distribution.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw (CWE-79, CWE-64) in the html-pages package where folder names are not properly sanitized before being rendered into HTML output. An attacker can create folders with names containing malicious JavaScript payloads; when these pages are generated and viewed in a browser, the injected script executes with the privileges of the viewing user. The attack vector is network-based and requires no authentication, but user interaction (viewing the generated page) is necessary. Exploitation allows arbitrary JavaScript execution in the browser context. No patch has been released; users are advised to use alternative packages.
Affected products
- html-pages html-pages 0 to 3.1.0
Timeline
- 2019-02-07: disclosed