Executive brief
Karma is a popular JavaScript test runner used to automate browser-based testing during software development. The tool contains a cross-site scripting vulnerability in how it handles the returnUrl query parameter, allowing an attacker to inject and execute malicious JavaScript code by crafting a malicious link. An attacker could exploit this to steal session cookies, redirect users to phishing sites, or deface the test runner interface.
Technical details
Karma prior to version 6.3.14 is vulnerable to cross-site scripting (CWE-79) via the returnUrl query parameter. The vulnerability exists because user-supplied input from the returnUrl parameter is not properly sanitized before being used in the application, allowing JavaScript code to be injected and executed in the user's browser. The attack vector is network-based with no authentication or special preconditions required; however, user interaction is necessary (the user must visit a crafted URL). An attacker can execute arbitrary JavaScript in the context of the Karma test runner, potentially compromising the testing environment or intercepting sensitive build data. The fix was released in version 6.3.14 and involves properly sanitizing the returnUrl parameter to prevent code injection.
Affected products
- Karma Karma before 6.3.14
Timeline
- 2022-02-06: disclosed
- 2022-02-06: patched: fix released in version 6.3.14