Critical XSS Vulnerability in @a2ui/web_core: openUrl Function Allows JavaScript Execution
Summary
GHSA-w72q-x6w3-7rj3: Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. Affects @a2ui/web_core versions >= 0.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @a2ui/web_core package is a JavaScript library designed to facilitate the creation of web applications with a focus on user interface components. It provides various functionalities, including the ability to handle button actions through the openUrl function. However, this package has a critical vulnerability that allows malicious users to execute arbitrary JavaScript code, posing a significant security risk to applications that utilize it.
Vulnerability Detail
The vulnerability arises from the openUrl function, which directly passes an agent-controlled URL to the window.open() method without validating the URI scheme. This oversight allows a malicious agent to supply a 'javascript:' URI as the url argument in a Button component's functionCall action. When a user clicks the button, arbitrary JavaScript executes in the context of the victim application's browser origin, leading to stored or reflected Cross-Site Scripting (XSS) attacks. This vulnerability is classified as critical due to its potential to compromise user data and application integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the URL before passing it to the openUrl function. Ensure that the URL does not start with 'javascript:' or any other potentially harmful schemes. Here is an example of how to validate the URL:
function safeOpenUrl(url) {
const validUrlPattern = /^(http|https):\/\/[^\s$.?#].[^\s]*$/;
if (validUrlPattern.test(url)) {
window.open(url);
} else {
console.error('Invalid URL');
}
}
Conclusion
The @a2ui/web_core package has a critical vulnerability in its openUrl function that allows for the execution of arbitrary JavaScript code. It is essential to update to version 0.10.2 or later to mitigate this risk. Users are encouraged to validate URLs and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for @a2ui/web_core →
FAQ
The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to arbitrary JavaScript execution, which may compromise user data, session hijacking, or other malicious activities.
Yes, the vulnerability has been patched in version 0.10.2 of the @a2ui/web_core package. It is recommended to update to this version.
If an immediate update is not possible, implement input validation as a temporary workaround to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @a2ui/web_core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
