cyntler / cyntler/react-doc-viewer
Security: Stored XSS in TXTRenderer via unsafe ReactNode casting
- Dominant language
- TypeScript
- Stars
- 481
- Forks
- 147
- PR merge metrics
- No merged PRs in 30d
Description
### Description
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `@cyntler/react-doc-viewer` package (v1.17.1). The vulnerability exists in the `TXTRenderer` component, which renders raw file content from `.txt` files by explicitly casting it as a `ReactNode` without any sanitization.
### Vulnerable Code
In `src/renderers/txt/index.tsx`:
```typescript
{currentDocument?.fileData as ReactNode}
##Proof of Concept (PoC)
To reproduce the vulnerability, create a file named exploit.txt with the following content and load it into the viewer:
Vulnerable!
alert('XSS_SUCCESS'); document.body.style.background='red';
##mpact
An attacker can execute arbitrary JavaScript in the victim's browser context. This can lead to:
Session Hijacking via Cookie theft.
Unauthorized actions performed on behalf of the user.
Website defacement and phishing attacks.
##Recommended Fix
Sanitize the input using a library like DOMPurify before rendering, or avoid casting raw strings to ReactNode.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.