Executive brief
@builder.io/qwik is a JavaScript framework for building web applications. The framework failed to properly sanitize attribute names and class attribute values during server-side rendering, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to theft of session tokens, credentials, or personal data from affected web applications built with vulnerable versions.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in @builder.io/qwik's server-side rendering (SSR) implementation. The root cause is improper sanitization of HTML attribute names and class attribute values, allowing an attacker to inject arbitrary HTML/JavaScript through these vectors. The attack requires user interaction (UI:R) but is network-reachable and requires no authentication. An attacker can craft a payload that executes JavaScript in the context of the affected web application, potentially stealing cookies, session tokens, or performing actions on behalf of the user. The vulnerability was fixed in version 0.16.2 via commit 4b2f89d, which implements proper cleansing of SSR attribute names and class values.
Affected products
- Builder.io Qwik before 0.16.2
Timeline
- 2023-01-20: disclosed
- 2023-01-20: patched: Version 0.16.2 released with fix