Executive brief
The @finastra/ssr-pages npm package is a server-side rendering utility used to construct message pages. A cross-site scripting (XSS) vulnerability allows attackers to inject malicious scripts by providing untrusted input to the redirect.link property, potentially compromising user sessions and stealing sensitive data from visitors to affected pages.
Technical details
This is a reflected/stored cross-site scripting (XSS) vulnerability (CWE-79) in the build(MessagePageOptions) function. The vulnerable component fails to properly sanitize or escape the redirect.link property when processing user-supplied input. An attacker can inject arbitrary JavaScript by crafting malicious redirect.link values; the attack requires user interaction (visiting a malicious link or page). The vulnerability affects all versions prior to 0.1.5, which includes the fix. Patches are available in version 0.1.5 and later.
Affected products
- Finastra ssr-pages before 0.1.5
Timeline
- 2022-03-01: disclosed
- 2022-03-01: patched: Fixed in version 0.1.5