Executive brief
Scully is a static site generation framework for Angular applications. This vulnerability allows attackers to inject malicious scripts into web pages by exploiting unsafe serialization of the transfer state object into HTML. An attacker can craft input that, when serialized with JSON.stringify() and embedded in the page, executes arbitrary JavaScript in the browser of anyone visiting the affected site.
Technical details
The vulnerability is a stored Cross-site Scripting (XSS) flaw in the transfer state serialization mechanism of Scully. The transfer state object is serialized using JSON.stringify() and then written directly into the HTML page without proper encoding or escaping. This allows an attacker to inject malicious payloads that break out of the JSON context and execute arbitrary JavaScript. The attack vector is network-based and requires no authentication. An attacker can achieve arbitrary code execution in the context of the user's browser, leading to session hijacking, credential theft, or defacement. The vulnerability was fixed in version 1.0.9 of @scullyio/scully and 1.0.1 of @scullyio/ng-lib.
Affected products
- Scullyio Scully before 1.0.9
- Scullyio ng-lib before 1.0.1
Timeline
- 2021-01-14: disclosed: NVD published date
- 2021-04-13: advisory: GHSA advisory published
- 2020-12-24: patched: Fix merged in pull request #1182