Executive brief
Nuclide is a development environment and code editor extension. A malicious deep link in the hhvm-attach debugger handler could be crafted to inject HTML and arbitrary content into the editor's context, potentially leading to code execution and compromise of the developer's system.
Technical details
The vulnerability is an improper input validation (CWE-20) and cross-site scripting (CWE-79) flaw in the hhvm-attach deep link handler. The handler failed to properly sanitize the hostname parameter before rendering it, allowing an attacker to inject malicious HTML and JavaScript. An attacker can craft a malicious URL and socially engineer a developer into clicking it; no authentication or special privileges are required. The vulnerability could lead to arbitrary code execution within the editor's context. The issue was fixed in version 0.290.0.
Affected products
- Facebook Nuclide prior to 0.290.0
Timeline
- 2022-05-13: disclosed
- 2018: patched: Fix released in version 0.290.0