Aurelia is one of many JavaScript frameworks available for front-end developers. Although nowadays, it is not as popular as Angular or React, its user base is not negligible: It has more than 11,000 stars and over a hundred contributors on its GitHub page. However, if you are one of its users, you need to be aware of its insecure default HTML sanitizer: relying solely on it to filter malicious input may leave you vulnerable to Cross Site Scripting (XSS) attacks.

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

aurelia-framework-image-feature
aurelia-framework-image-feature
Aurelia is one of many JavaScript frameworks available for front-end developers. Although nowadays, it is not as popular as Angular or React, its user base is not negligible: It has more than 11,000 stars and over a hundred contributors on its GitHub page. However, if you are one of its users, you need to be aware of its insecure default HTML sanitizer: relying solely on it to filter malicious input may leave you vulnerable to Cross Site Scripting (XSS) attacks.

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

Vulnerability Context

Using Aurelia, it is possible to data bind HTML attributes or elements content to JavaScript expressions. For example, a user can choose to bind an element’s “innerHTML” to Aurelia’s HTML Sanitizer.
<div innerhtml.bind="htmlProperty | sanitizeHTML"></div>
Code Excerpt 1– Binding innerHTML

Technical Analysis

By default, Aurelia’s HTML sanitizer only attempts to filter SCRIPT elements, which makes it easier for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed.
Import { getLogger } from 'aurelia-logging';
	
	const SCRIPT_REGEX = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
	let needsToWarn = true;
	
	/**
	 * Default Html Sanitizer to prevent script injection.
	 */
	export class HTMLSanitizer {
	  /**
	   * Sanitizes the provided input.
	   * @param input The input to be sanitized.
	   */
	  sanitize(input) {
	    if (needsToWarn) {
	      needsToWarn = false;
	
	      getLogger('html-sanitizer')
	        .warn('CAUTION: The default HTMLSanitizer does NOT provide security against a wide variety of sophisticated XSS attacks,
	and should not be relied on for sanitizing input from unknown sources.
	Please see https://aurelia.io/docs/binding/basics#element-content for instructions on how to use a secure solution like DOMPurify or sanitize-html.');
	    }
	
	    return input.replace(SCRIPT_REGEX, '');
	  }
	}
Code Excerpt 1- https://github.com/aurelia/templating-resources/blob/master/src/html-sanitizer.ts
For example, payloads as simple as these will not be filtered:
<scr<script>ipt>alert('XSS')</scr</script>ipt>

<img src="x" onerror="alert('XSS')"/>
Code Excerpt 3 – XSS payloads

Impact

Users that rely solely on the default sanitizer to filter malicious JavaScript inputs are not safe from Cross Site Scripting (XSS). Depending on the application, consequences vary from session robbery to leak of sensitive information.

This vulnerability affects all released versions of the Aurelia framework 1.x repository.

Vendor Response

Since we reported the vulnerability, Aurelia’s team has added a warning (as can also be seen above), advising its users not to rely on its default sanitizer and provides instructions on how to override it to use a safer alternative. It is not clear at this point if there will eventually be a patch for this.

Mitigation

As instructed by Aurelia, users can register their own version of “HTMLSanitizer”, preferably by using established tools such as “DOMPurify” or “sanitize-html” instead of making their own implementation.

For example, at startup, the following can be used to override “HTMLSanitizer”:

aurelia.use.singleton(HTMLSanitizer, SecureHTMLSanitizer);
Code Excerpt 3 – Overriding « HTMLSanitizer »

Conclusion

While this is still an existing issue in all default deployments of the Aurelia framework, users can easily override the insecure HTML sanitizer for a more secure alternative. Aurelia does warn its users from that behavior in its documentation and in the browser’s console log. Lastly, Aurelia’s development has been slowing down, the 2.0 version of its framework hasn’t been released and its biggest 1.x contributor is now working at Microsoft on fast so it remains to be seen what the future of the Aurelia framework [and its security] is.

Détection et réponse gérées Titan
Antivirus de nouvelle génération
Détection et réponse sur les terminaux
Détection et réponse sur le réseau
Détection et réponse sur les boîtes de messagerie
Détection et réponse face aux menaces internes
Gestion des pare-feu
Gestion des SIEM
La gestion des vulnérabilités en tant que service
GoSecure Titan
Logiciel Titan
Sécurité de la messagerie
Sécurité Web
Boîte à outils «Responder PRO Forensics»
Services professionnels
Services de détection de brèches
Évaluation de la cybersécurité
Évaluation de la compromission de la sécurité
Piratage éthique
Réponse aux incidents et analyse de type «forensics»
Services de conformité et d’audit
Technologies fournies par des tiers

Pin It on Pinterest

Share This