Executive brief
Octocat.js is a JavaScript library for rendering customizable avatar images. The library fails to validate user-supplied image URLs for accessories, allowing attackers to inject and execute arbitrary JavaScript code on any website using this library. This vulnerability could lead to session hijacking, credential theft, or malware distribution to end users.
Technical details
The vulnerability is a code injection flaw (CWE-74, CWE-94) in Octocat.js version <1.2 where user-supplied URLs for custom accessories are not validated before being rendered. An attacker can craft a malicious URL containing JavaScript that executes when the rendered image is displayed on a webpage. The attack requires no authentication and can be exploited by any user able to provide custom image URLs to the library. The vulnerability was patched in version 1.2, and the recommended workaround is to write images to disk rather than directly exposing rendered URLs in image elements.
Affected products
- Octocademy Octocat.js <1.2
Timeline
- 2022-11-08: disclosed
- 2022-11-08: patched: version 1.2 released