Executive brief
Aurelia Framework is a popular JavaScript framework used to build interactive web applications. Its built-in HTML sanitizer has insufficient filtering, allowing attackers to inject malicious JavaScript code via HTML attributes or nested SCRIPT elements. This can lead to account takeover, credential theft, or malware distribution when applications use the framework's default sanitization without additional protections.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the HTMLSanitizer class in html-sanitizer.ts affecting all Aurelia Framework 1.x versions prior to 1.4.1. The sanitizer only attempts to filter SCRIPT elements but fails to handle JavaScript execution via event handler attributes (e.g., onclick, onerror) on other HTML elements, nor does it properly handle bypasses through nested or split SCRIPT string constructs. An attacker can inject malicious JavaScript through crafted HTML containing attributes with embedded code or variations of SCRIPT tags. The vulnerability is exploitable by any input accepted and rendered by an application using Aurelia's default sanitizer without additional controls. A fix was released in version 1.4.1 and later.
Affected products
- Aurelia Framework 1.x < 1.4.1
Timeline
- 2021-05-13: disclosed: CVE-2019-10062 published on NVD
- 2021-05-17: patched: GitHub advisory reviewed and published