Aurelia Framework Insecure Default Allows XSS

Aurelia is one of many JavaScript frameworks available for front-end developers. Although nowadays, it is not as popular as Angular or React, its user base is not negligible: It has more than 11,000 stars and over a hundred contributors on its GitHub page. However, if you are one of its users, you need to be aware of its insecure default HTML sanitizer: relying solely on it to filter malicious input may leave you vulnerable to Cross Site Scripting (XSS) attacks.

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

Aurelia is one of many JavaScript frameworks available for front-end developers. Although nowadays, it is not as popular as Angular or React, its user base is not negligible: It has more than 11,000 stars and over a hundred contributors on its GitHub page. However, if you are one of its users, you need to be aware of its insecure default HTML sanitizer: relying solely on it to filter malicious input may leave you vulnerable to Cross Site Scripting (XSS) attacks.

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

Vulnerability Context

Using Aurelia, it is possible to data bind HTML attributes or elements content to JavaScript expressions. For example, a user can choose to bind an element’s “innerHTML” to Aurelia’s HTML Sanitizer.

<div innerhtml.bind="htmlProperty | sanitizeHTML"></div>

Code Excerpt 1– Binding innerHTML

Technical Analysis

By default, Aurelia’s HTML sanitizer only attempts to filter SCRIPT elements, which makes it easier for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed.

Import { getLogger } from 'aurelia-logging';
	
	const SCRIPT_REGEX = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
	let needsToWarn = true;
	
	/**
	 * Default Html Sanitizer to prevent script injection.
	 */
	export class HTMLSanitizer {
	  /**
	   * Sanitizes the provided input.
	   * @param input The input to be sanitized.
	   */
	  sanitize(input) {
	    if (needsToWarn) {
	      needsToWarn = false;
	
	      getLogger('html-sanitizer')
	        .warn('CAUTION: The default HTMLSanitizer does NOT provide security against a wide variety of sophisticated XSS attacks,
	and should not be relied on for sanitizing input from unknown sources.
	Please see https://aurelia.io/docs/binding/basics#element-content for instructions on how to use a secure solution like DOMPurify or sanitize-html.');
	    }
	
	    return input.replace(SCRIPT_REGEX, '');
	  }
	}

Code Excerpt 1- https://github.com/aurelia/templating-resources/blob/master/src/html-sanitizer.ts

For example, payloads as simple as these will not be filtered:

<scr<script>ipt>alert('XSS')</scr</script>ipt>

<img src="x" onerror="alert('XSS')"/>

Code Excerpt 3 – XSS payloads

Impact

Users that rely solely on the default sanitizer to filter malicious JavaScript inputs are not safe from Cross Site Scripting (XSS). Depending on the application, consequences vary from session robbery to leak of sensitive information.

This vulnerability affects all released versions of the Aurelia framework 1.x repository.

Vendor Response

Since we reported the vulnerability, Aurelia’s team has added a warning (as can also be seen above), advising its users not to rely on its default sanitizer and provides instructions on how to override it to use a safer alternative. It is not clear at this point if there will eventually be a patch for this.

Mitigation

As instructed by Aurelia, users can register their own version of “HTMLSanitizer”, preferably by using established tools such as “DOMPurify” or “sanitize-html” instead of making their own implementation.

For example, at startup, the following can be used to override “HTMLSanitizer”:

aurelia.use.singleton(HTMLSanitizer, SecureHTMLSanitizer);

Code Excerpt 3 – Overriding « HTMLSanitizer »

Conclusion

While this is still an existing issue in all default deployments of the Aurelia framework, users can easily override the insecure HTML sanitizer for a more secure alternative. Aurelia does warn its users from that behavior in its documentation and in the browser’s console log. Lastly, Aurelia’s development has been slowing down, the 2.0 version of its framework hasn’t been released and its biggest 1.x contributor is now working at Microsoft on fast so it remains to be seen what the future of the Aurelia framework [and its security] is.