Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

QuestId may cause stored XSS (Cross Site Scripting) #177

Open
code423n4 opened this issue Jan 28, 2023 · 7 comments
Open

QuestId may cause stored XSS (Cross Site Scripting) #177

code423n4 opened this issue Jan 28, 2023 · 7 comments
Labels
bug Something isn't working downgraded by judge Judge downgraded the risk level of this issue edited-by-warden grade-b primary issue Highest quality submission among a set of duplicates Q-73 QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax

Comments

@code423n4
Copy link
Contributor

code423n4 commented Jan 28, 2023 •
edited
Loading

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/ReceiptRenderer.sol#L106

Vulnerability details

Impact

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/ReceiptRenderer.sol#L106
QuestId is embeded into the svg of the NFT directly, so an attacker can create a quest with a malicious QuestId to inject Javascript code into the svg.

According to the sponsor, the NFT minted by RabbitHoleReceipt.sol will be displayed on their website. The severity/validity of this vulnerability depends on how the website handles these svgs. If the website performs no sanitization, then this causes a stored XSS vulnerability, allowing the attacker to execute javascript on the client visiting the page (the impact of which can vary between information disclosure to account compromise, again depending on the implementation of the website).

Although this is more or less speculative, I think this issue can be easily overlooked since the website might blindly trust data from smart contracts, so I'm reporting it as a medium for now.

Proof of Concept

Unfortunately, there's no way for me to verify the behaviour on the actual website.
If you would like to test, try creating a quest with payload </text><script>alert(1)</script><text> as questId, then mint a receipt NFT for this quest.
If the vulnerability exists, then there should be an alert box popping up on the website when this NFT is displayed, thus proving javascript execution.

Tools Used

Hardhat, VSCode

Recommended Mitigation Steps

Enforce QuestId to alphanumerical.
@code423n4 code423n4 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Jan 28, 2023
code423n4 added a commit that referenced this issue Jan 28, 2023
@code423n4
evan issue #177
c00f24c
@c4-judge c4-judge added downgraded by judge Judge downgraded the risk level of this issue QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax and removed 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value labels Feb 5, 2023
@c4-judge
Copy link
Contributor

c4-judge commented Feb 5, 2023

kirk-baird changed the severity to QA (Quality Assurance)

@c4-judge c4-judge added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value and removed downgraded by judge Judge downgraded the risk level of this issue QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax labels Feb 5, 2023
@c4-judge
Copy link
Contributor

c4-judge commented Feb 5, 2023

This previously downgraded issue has been upgraded by kirk-baird

1 similar comment
@c4-judge
Copy link
Contributor

c4-judge commented Feb 5, 2023

This previously downgraded issue has been upgraded by kirk-baird

@c4-judge c4-judge added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value primary issue Highest quality submission among a set of duplicates labels Feb 5, 2023
@c4-judge
Copy link
Contributor

c4-judge commented Feb 5, 2023

kirk-baird marked the issue as primary issue

This was referenced Feb 5, 2023
Closed
Closed
Closed
@c4-judge
Copy link
Contributor

kirk-baird changed the severity to QA (Quality Assurance)

@c4-judge c4-judge added downgraded by judge Judge downgraded the risk level of this issue QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax and removed 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value labels Feb 16, 2023
@kirk-baird
Copy link

Rating this issue as QA as front-ends should sanatize all data they receive

@c4-judge
Copy link
Contributor

kirk-baird marked the issue as grade-b

@C4-Staff C4-Staff added the Q-73 label Feb 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working downgraded by judge Judge downgraded the risk level of this issue edited-by-warden grade-b primary issue Highest quality submission among a set of duplicates Q-73 QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@kirk-baird @code423n4 @c4-judge @C4-Staff