Cross-site scripting through SVG creation

[code423n4]

Lines of code

https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/TicketRenderer.sol#L33-L48
https://github.com/rabbitholegg/quest-protocol/blob/8c4c1f71221570b14a0479c216583342bd652d8d/contracts/ReceiptRenderer.sol#L100-L115

Vulnerability details

Impact

XSS attacks will be present when SVG is loaded.

Proof of Concept

Cross-site scripting attacks, also called XSS attacks, are a type of injection attack that injects malicious code into otherwise safe websites. If a malicious user is able to inject malicious Javascript into a SVG file, then any user who views the SVG on a website will be susceptible to XSS. This can lead stolen cookies, Denial of Service attacks, and more. When generating the ERC721 receipt, the malicious user can set malicious XSS into the tokenId or questId. When SVG is loaded on any site, any user viewing the SVG will load the malicious Javascript as well from within the SVG and result in XSS attack.

function generateSVG(uint tokenId_, string memory questId_) public pure returns (string memory) {
    bytes memory svg = abi.encodePacked(
        '<svg xmlns="http://www.w3.org/2000/svg" preserveAspectRatio="xMinYMin meet" viewBox="0 0 350 350">',
        '<style>.base { fill: white; font-family: serif; font-size: 14px; }</style>',
        '<rect width="100%" height="100%" fill="black" />',
        '<text x="50%" y="40%" class="base" dominant-baseline="middle" text-anchor="middle">RabbitHole Quest #',
        questId_,
        '</text>',
        '<text x="70%" y="40%" class="base" dominant-baseline="middle" text-anchor="middle">RabbitHole Quest Receipt #',
        tokenId_,
        '</text>',
        '</svg>'
    );
    return string(abi.encodePacked('data:image/svg+xml;base64,', Base64.encode(svg)));
}

}

https://research.securitum.com/do-you-allow-to-load-svg-files-you-have-xss/

Reference: code-423n4/2022-01-timeswap-findings#131

Tools Used

Manual Review

Recommended Mitigation Steps

Don't generate the svg or remove all user-input data from the svg file.

[c4-judge]

kirk-baird marked the issue as duplicate of #177

[c4-judge]

kirk-baird marked the issue as satisfactory

[c4-judge]

kirk-baird changed the severity to QA (Quality Assurance)

[c4-judge]

kirk-baird marked the issue as grade-b