Executive brief
hello.js is a JavaScript library used to integrate third-party authentication services (OAuth providers) into web applications. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious code through the oauth_redirect URL parameter without validation, enabling them to steal user credentials, hijack sessions, or compromise the integrity of the affected application.
Technical details
The vulnerability is a reflected XSS flaw in hello.js versions before 1.18.6. The library's OAuth redirect handler extracts the oauth_redirect parameter from the URL and passes it directly to location.assign() without validation or sanitization. An attacker can craft a malicious URL containing a javascript: protocol payload (e.g., javascript:alert(1)) in the oauth_redirect parameter. This allows arbitrary JavaScript execution in the context of the application. No authentication is required; the attack is network-accessible and triggered by user interaction (visiting a crafted link). The fix, implemented in version 1.18.6, validates that oauth_redirect is a legitimate URL before using it.
Affected products
- MrSwitch hello.js before 1.18.6
Timeline
- 2020-10-06: disclosed: NVD published
- 2021-01-13: advisory: GHSA published
- 2021-01-13: patched: Fix available in version 1.18.6