Aurelia is one of many JavaScript frameworks available for front-end developers. Although nowadays, it is not as popular as Angular or React, its user base is not negligible: It has more than 11,000 stars and over a hundred contributors on its GitHub page. However, if you are one of its users, you need to be aware of its insecure default HTML sanitizer: relying solely on it to filter malicious input may leave you vulnerable to Cross Site Scripting (XSS) attacks.

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

aurelia-framework-image-feature
aurelia-framework-image-feature

Aurelia is one of many JavaScript frameworks available for front-end developers. Although nowadays, it is not as popular as Angular or React, its user base is not negligible: It has more than 11,000 stars and over a hundred contributors on its GitHub page. However, if you are one of its users, you need to be aware of its insecure default HTML sanitizer: relying solely on it to filter malicious input may leave you vulnerable to Cross Site Scripting (XSS) attacks.

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

Vulnerability Context

Using Aurelia, it is possible to data bind HTML attributes or elements content to JavaScript expressions. For example, a user can choose to bind an element’s “innerHTML” to Aurelia’s HTML Sanitizer.
<div innerhtml.bind="htmlProperty | sanitizeHTML"></div>
Code Excerpt 1– Binding innerHTML

Technical Analysis

By default, Aurelia’s HTML sanitizer only attempts to filter SCRIPT elements, which makes it easier for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed.
Import { getLogger } from 'aurelia-logging';

	const SCRIPT_REGEX = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
	let needsToWarn = true;

	/**
	 * Default Html Sanitizer to prevent script injection.
	 */
	export class HTMLSanitizer {
	  /**
	   * Sanitizes the provided input.
	   * @param input The input to be sanitized.
	   */
	  sanitize(input) {
	    if (needsToWarn) {
	      needsToWarn = false;

	      getLogger('html-sanitizer')
	        .warn('CAUTION: The default HTMLSanitizer does NOT provide security against a wide variety of sophisticated XSS attacks,
	and should not be relied on for sanitizing input from unknown sources.
	Please see https://aurelia.io/docs/binding/basics#element-content for instructions on how to use a secure solution like DOMPurify or sanitize-html.');
	    }

	    return input.replace(SCRIPT_REGEX, '');
	  }
	}
Code Excerpt 1- https://github.com/aurelia/templating-resources/blob/master/src/html-sanitizer.ts
For example, payloads as simple as these will not be filtered:
<scr<script>ipt>alert('XSS')</scr</script>ipt>

<img src="x" onerror="alert('XSS')"/>
Code Excerpt 3 – XSS payloads

Impact

Users that rely solely on the default sanitizer to filter malicious JavaScript inputs are not safe from Cross Site Scripting (XSS). Depending on the application, consequences vary from session robbery to leak of sensitive information.

This vulnerability affects all released versions of the Aurelia framework 1.x repository.

Vendor Response

Since we reported the vulnerability, Aurelia’s team has added a warning (as can also be seen above), advising its users not to rely on its default sanitizer and provides instructions on how to override it to use a safer alternative. It is not clear at this point if there will eventually be a patch for this.

Mitigation

As instructed by Aurelia, users can register their own version of “HTMLSanitizer”, preferably by using established tools such as “DOMPurify” or “sanitize-html” instead of making their own implementation.

For example, at startup, the following can be used to override “HTMLSanitizer”:

aurelia.use.singleton(HTMLSanitizer, SecureHTMLSanitizer);
Code Excerpt 3 – Overriding « HTMLSanitizer »

Conclusion

While this is still an existing issue in all default deployments of the Aurelia framework, users can easily override the insecure HTML sanitizer for a more secure alternative. Aurelia does warn its users from that behavior in its documentation and in the browser’s console log. Lastly, Aurelia’s development has been slowing down, the 2.0 version of its framework hasn’t been released and its biggest 1.x contributor is now working at Microsoft on fast so it remains to be seen what the future of the Aurelia framework [and its security] is.

GoSecure Titan® Managed Extended Detection & Response (MXDR)​

GoSecure Titan® Managed Extended Detection & Response (MXDR)​ Foundation

GoSecure Titan® Vulnerability Management as a Service (VMaaS)

GoSecure Titan® Managed Security Information & Event Monitoring (SIEM)

GoSecure Titan® Managed Perimeter Defense​ (MPD)

GoSecure Titan® Inbox Detection and Response (IDR)

GoSecure Titan® Platform

GoSecure Professional Security Services

Incident Response Services

Security Maturity Assessment

Privacy Services

PCI DSS Services

Penetration Testing Services​

Security Operations

MicrosoftLogo

GoSecure MXDR for Microsoft

Comprehensive visibility and response within your Microsoft security environment

USE CASES

Cyber Risks

Risk-Based Security Measures

Sensitive Data Security

Safeguard sensitive information

Private Equity Firms

Make informed decisions

Cybersecurity Compliance

Fulfill regulatory obligations

Cyber Insurance

A valuable risk management strategy

Ransomware

Combat ransomware with innovative security

Zero-Day Attacks

Halt zero-day exploits with advanced protection

Consolidate, Evolve & Thrive

Get ahead and win the race with the GoSecure Titan® Platform

24/7 MXDR FOUNDATION

GoSecure Titan® Endpoint Detection and Response (EDR)

GoSecure Titan® Next Generation Antivirus (NGAV)

GoSecure Titan® Network Detection and Response (NDR)

GoSecure Titan® Inbox Detection and Reponse (IDR)

GoSecure Titan® Intelligence

ABOUT GOSECURE

GoSecure is a recognized cybersecurity leader and innovator, pioneering the integration of endpoint, network, and email threat detection into a single Managed Extended Detection and Response (MXDR) service. For over 20 years, GoSecure has been helping customers better understand their security gaps and improve their organizational risk and security maturity through MXDR and Professional Services solutions delivered by one of the most trusted and skilled teams in the industry.

LATEST PRESS RELEASE

GOSECURE BLOG

SECURITY ADVISORIES

 24/7 Emergency – (888)-287-5858