Executive brief
SockJS-node is a WebSocket emulation library used in web applications to enable real-time bidirectional communication. The library fails to properly sanitize the callback parameter in the htmlfile transport mechanism, allowing attackers to inject malicious scripts that execute in users' browsers. This can lead to session hijacking, credential theft, or defacement of the affected web application.
Technical details
The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw in the htmlfile transport handler in lib/transport/htmlfile.js of SockJS-node. The /htmlfile endpoint fails to properly sanitize the callback (c) parameter, allowing attackers to inject arbitrary JavaScript code. The attack is network-reachable and requires user interaction (clicking a malicious link or visiting an attacker-controlled page), but does not require authentication. An attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser within the context of the vulnerable application. The vulnerability was fixed in SockJS version 0.3.0 and later.
Affected products
- SockJS SockJS-node before 0.3.0
Timeline
- 2020-02-10: disclosed
- 2021-04-13: advisory