Executive brief
The @dcl/single-sign-on-client npm library, used to provide authentication for Decentraland applications, fails to properly validate input passed to its initialization function. An attacker can inject arbitrary JavaScript code using the "javascript:" protocol, allowing them to steal session tokens, redirect users to malicious sites, or perform actions on behalf of authenticated users.
Technical details
This is a cross-site scripting (XSS) vulnerability caused by improper neutralization of script attributes in the init function. The vulnerable code does not sanitize or validate the input parameter, allowing an attacker to pass a string prefixed with "javascript:" (e.g., SSO.init('javascript:alert("injected")')) to execute arbitrary JavaScript in the browser context. The vulnerability affects all versions prior to 0.1.0 and requires no authentication or user interaction—only that an application calls the init function with untrusted input. The vulnerability was patched in version 0.1.0.
Affected products
- Decentraland single-sign-on-client <0.1.0
Timeline
- 2023-09-04: disclosed
- 2023-09-04: patched: Version 0.1.0