Identity Server Security Bug: DOM text reinterpreted as HTML

[alexhiggins732]

DOM text reinterpreted as HTML

The original Identity Server 4 code base has several medium impact security bugs detected by CodeQL scanning.

Description:

Extracting text from a DOM node and interpreting it as HTML can lead to a cross-site scripting vulnerability.

A webpage with this vulnerability reads text from the DOM, and afterwards adds the text as HTML to the DOM. Using text from the DOM as HTML effectively unescapes the text, and thereby invalidates any escaping done on the text. If an attacker is able to control the safe sanitized text, then this vulnerability can be exploited to perform a cross-site scripting attack.

Examples

Tool	Rule ID	Source
CodeQL	js/unsafe-html-expansion	wwroot/js/signin-redirect.js#L1-L1

window.location.href = document.querySelector("meta[http-equiv=refresh]").getAttribute("data-url");

Issues:

• Issue 1 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/1
• Issue 2 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/2
• Issue 3 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/3
• Issue 4 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/4
• Issue 5 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/5
• Issue 6 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/6
• Issue 7 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/7
• Issue 8 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/8
• Issue 9 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/9
• Issue 10 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/10
• Issue 11 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/11
• Issue 12 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/12
• Issue 13 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/13
• Issue 14 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/14
• Issue 15 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/15
• Issue 16 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/16
• Issue 17 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/17
• Issue 18 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/18
• Issue 19 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/19
• Issue 20 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/20
• Issue 21 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/21
• Issue 22 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/22
• Issue 23 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/23
• Issue 24 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/24
• Issue 25 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/25
• Issue 26 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/26
• Issue 27 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/27
• Issue 28 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/28
• Issue 29 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/29
• Issue 30 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/30
• Issue 31 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/31
• Issue 32 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/32
• Issue 33 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/33
• Issue 34 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/34
• Issue 35 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/35
• Issue 36 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/36
• Issue 37 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/37
• Issue 38 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/38
• Issue 39 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/39
• Issue 40 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/40
• Issue 41 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/41
• Issue 42 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/42
• Issue 43 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/43
• Issue 44 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/44
• Issue 45 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/45
• Issue 46 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/46
• Issue 47 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/47
• Issue 48 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/48
• Issue 49 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/49
• Issue 50 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/50
• Issue 51 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/51
• Issue 52 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/52
• Issue 53 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/53
• Issue 54 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/54
• Issue 55 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/55
• Issue 56 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/56
• Issue 57 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/57
• Issue 58 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/58
• Issue 59 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/59
• Issue 60 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/60
• Issue 61 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/61
• Issue 62 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/62
• Issue 63 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/63
• Issue 64 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/64
• Issue 65 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/65
• Issue 66 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/66
• Issue 67 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/67
• Issue 68 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/68
• Issue 69 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/69
• Issue 70 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/70
• Issue 71 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/71
• Issue 72 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/72
• Issue 73 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/73
• Issue 74 - https://github.com/alexhiggins732/IdentityServer8/security/code-scanning/74

Recommendation

To guard against cross-site scripting, consider using contextual output encoding/escaping before writing text to the page, or one of the other solutions that are mentioned in the References section below.

Example

The following example shows a webpage using a data-target attribute to select and manipulate a DOM element using the JQuery library. In the example, the data-target attribute is read into the target variable, and the $ function is then supposed to use the target variable as a CSS selector to determine which element should be manipulated.

$("button").click(function () {
    var target = $(this).attr("data-target");
    $(target).hide();
});

However, if an attacker can control the data-target attribute, then the value of target can be used to cause the $ function to execute arbitrary JavaScript.

The above vulnerability can be fixed by using $.find instead of $. The $.find function will only interpret target as a CSS selector and never as HTML, thereby preventing an XSS attack.

$("button").click(function () {
    var target = $(this).attr("data-target");
	$.find(target).hide();
});

References

• OWASP: DOM based XSS Prevention Cheat Sheet.
• OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet.
• OWASP DOM Based XSS.
• OWASP Types of Cross-Site Scripting.
• Wikipedia: Cross-site scripting.
• Common Weakness Enumeration: CWE-79.
• Common Weakness Enumeration: CWE-116.