Aurelia Framework Insecure Default Allows XSS

Aurelia is one of many JavaScript frameworks available for front-end developers. Although nowadays, it is not as popular as Angular or React, its user base is not negligible: It has more than 11,000 stars and over a hundred contributors on its GitHub page. However, if you are one of its users, you need to be aware of its insecure default HTML sanitizer: relying solely on it to filter malicious input may leave you vulnerable to Cross Site Scripting (XSS) attacks.

GoSecure became aware of this vulnerability during a Web application intrusion testing engagement and has since reported it to Aurelia’s team.

This vulnerability has been assigned CVE-2019-10062.

Vulnerability Context

<div innerhtml.bind="htmlProperty | sanitizeHTML"></div>

Technical Analysis

Import { getLogger } from 'aurelia-logging';

	const SCRIPT_REGEX = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
	let needsToWarn = true;

	/**
	 * Default Html Sanitizer to prevent script injection.
	 */
	export class HTMLSanitizer {
	  /**
	   * Sanitizes the provided input.
	   * @param input The input to be sanitized.
	   */
	  sanitize(input) {
	    if (needsToWarn) {
	      needsToWarn = false;

	      getLogger('html-sanitizer')
	        .warn('CAUTION: The default HTMLSanitizer does NOT provide security against a wide variety of sophisticated XSS attacks,
	and should not be relied on for sanitizing input from unknown sources.
	Please see https://aurelia.io/docs/binding/basics#element-content for instructions on how to use a secure solution like DOMPurify or sanitize-html.');
	    }

	    return input.replace(SCRIPT_REGEX, '');
	  }
	}

<scr<script>ipt>alert('XSS')</scr</script>ipt>

<img src="x" onerror="alert('XSS')"/>

Impact

Users that rely solely on the default sanitizer to filter malicious JavaScript inputs are not safe from Cross Site Scripting (XSS). Depending on the application, consequences vary from session robbery to leak of sensitive information.

This vulnerability affects all released versions of the Aurelia framework 1.x repository.

Vendor Response

Since we reported the vulnerability, Aurelia’s team has added a warning (as can also be seen above), advising its users not to rely on its default sanitizer and provides instructions on how to override it to use a safer alternative. It is not clear at this point if there will eventually be a patch for this.

Mitigation

For example, at startup, the following can be used to override « HTMLSanitizer »:

aurelia.use.singleton(HTMLSanitizer, SecureHTMLSanitizer);

Conclusion

While this is still an existing issue in all default deployments of the Aurelia framework, users can easily override the insecure HTML sanitizer for a more secure alternative. Aurelia does warn its users from that behavior in its documentation and in the browser’s console log. Lastly, Aurelia’s development has been slowing down, the 2.0 version of its framework hasn’t been released and its biggest 1.x contributor is now working at Microsoft on fast so it remains to be seen what the future of the Aurelia framework [and its security] is.