cyntler / cyntler/react-doc-viewer

Security: Stored XSS in TXTRenderer via unsafe ReactNode casting

Open
#317 1 comment 2 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
481
Forks
147
PR merge metrics
No merged PRs in 30d

Description

### Description
A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `@cyntler/react-doc-viewer` package (v1.17.1). The vulnerability exists in the `TXTRenderer` component, which renders raw file content from `.txt` files by explicitly casting it as a `ReactNode` without any sanitization.

### Vulnerable Code
In `src/renderers/txt/index.tsx`:
```typescript
{currentDocument?.fileData as ReactNode}

##Proof of Concept (PoC)
To reproduce the vulnerability, create a file named exploit.txt with the following content and load it into the viewer:

Vulnerable!


alert('XSS_SUCCESS'); document.body.style.background='red';

##mpact
An attacker can execute arbitrary JavaScript in the victim's browser context. This can lead to:
Session Hijacking via Cookie theft.
Unauthorized actions performed on behalf of the user.
Website defacement and phishing attacks.

##Recommended Fix
Sanitize the input using a library like DOMPurify before rendering, or avoid casting raw strings to ReactNode.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.