Aurelia Framework Insecure Default Allows XSS

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

Vulnerability Context

<div innerhtml.bind="htmlProperty | sanitizeHTML"></div>

Technical Analysis

Import { getLogger } from 'aurelia-logging';
	
	const SCRIPT_REGEX = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
	let needsToWarn = true;
	
	/**
	 * Default Html Sanitizer to prevent script injection.
	 */
	export class HTMLSanitizer {
	  /**
	   * Sanitizes the provided input.
	   * @param input The input to be sanitized.
	   */
	  sanitize(input) {
	    if (needsToWarn) {
	      needsToWarn = false;
	
	      getLogger('html-sanitizer')
	        .warn('CAUTION: The default HTMLSanitizer does NOT provide security against a wide variety of sophisticated XSS attacks,
	and should not be relied on for sanitizing input from unknown sources.
	Please see https://aurelia.io/docs/binding/basics#element-content for instructions on how to use a secure solution like DOMPurify or sanitize-html.');
	    }
	
	    return input.replace(SCRIPT_REGEX, '');
	  }
	}

<scr<script>ipt>alert('XSS')</scr</script>ipt>

<img src="x" onerror="alert('XSS')"/>

Impact

This vulnerability affects all released versions of the Aurelia framework 1.x repository.

Vendor Response

Since we reported the vulnerability, Aurelia’s team has added a warning (as can also be seen above), advising its users not to rely on its default sanitizer and provides instructions on how to override it to use a safer alternative. It is not clear at this point if there will eventually be a patch for this.

Mitigation

For example, at startup, the following can be used to override “HTMLSanitizer”:

aurelia.use.singleton(HTMLSanitizer, SecureHTMLSanitizer);

Conclusion

While this is still an existing issue in all default deployments of the Aurelia framework, users can easily override the insecure HTML sanitizer for a more secure alternative. Aurelia does warn its users from that behavior in its documentation and in the browser’s console log. Lastly, Aurelia’s development has been slowing down, the 2.0 version of its framework hasn’t been released and its biggest 1.x contributor is now working at Microsoft on fast so it remains to be seen what the future of the Aurelia framework [and its security] is.