security-report_LABYnet_may_2023.md

Index

1. Introduction
2. Identified Vulnerabilities
   1. LBN-01-001: Stored XSS in cloak profile via texture name
   2. LBN-01-002: DOM-based XSS in search page via q parameter
   3. LBN-01-003: DOM-based XSS in cloaks page via input parameter
   4. LBN-01-004: DOM-based XSS in bandanas page via input parameter
   5. LBN-01-005: DOM-based XSS in skins page via input parameter
   6. LBN-01-006: HTML Injection in @user profile via social-icon tooltip
3. Report Timeline

Introduction

"LABY.net is the ultra fast and clean Minecraft user search and skin library. Browse through thousands of skins, capes and cloaks. Look up UUIDs or visit your friends' profiles to see their LabyMod stats. Completely free, fast and without ads." _{— twitter.com/LabyMod/status/1411021855423713286}

This report describes the results of an independent black-box security assessment of https://LABY.net.
Made by Slowftw in late May 2023 for self-learning, support and contribution to the website.
No organization or specialized team involved.

Identified Vulnerabilities

The findings have been listed ordered by their degree of severity and impact. The severity ranking is provided with a colored badge image or simply in parenthesis after the title of each vulnerability. Each vulnerability is additionally given a unique identifier (e.g. XYZ-01-001) for the purpose of facilitating any future follow-up correspondence. The code analysis was done in Firefox Developer Tools (113.0.2/Win10) from bundled/webpack production builds using a personal account with normal user privileges, which required more time to understand and potentially decreased the findings.

LBN-01-001: Stored XSS in cloak profile via texture name

What is Stored XSS?

Stored Cross-site Scripting occurs when a web application gathers input from a user which might be malicious, and then stores that input in a data store for later use. The input that is stored is not correctly filtered. As a consequence, the malicious data will appear to be part of the web site and run within the user's browser under the privileges of the web application. Read more in portswigger.net

Description

• The name of the texture/cloak is inserted into the 'Information' card using innerHTML without escaping, allowing XSS.
  Attackers could trick users into executing arbitrary JS code and stealing their cookies just by viewing the page.
  The victim would visit the page unsuspectingly because it would be a trusted domain/link.

Steps to Reproduce

1. Upload a new https://laby.net/cloaks (e.g. with random pixels to generate a new imageHash);
2. Paste the payload in texture name (must include onxs=s):
   <details/open="onxs=s"ontoggle=alert(document.domain)>
3. Click 'Upload' and you will be redirected to cloak's profile, triggering the alert popup.
4. Example result: https://laby.net/cloak/441156c1067883c5f981ad6e52b54bf7
   

Affected Code

• https://laby.net/build/js/head.438eb2e5.js
  

Suggested Mitigation

• Use textContent instead of innerHTML to escape user-controlled input.
  Read more how to prevent XSS attacks.

t.dataset.trans === "textures.name"
  ? (t.textContent = o(t.dataset.trans, t))
  : (t.innerHTML = o(t.dataset.trans, t));

LBN-01-002: DOM-based XSS in search page via q parameter

What is DOM-based?

DOM-based XSS vulnerabilities usually arise when JavaScript takes data from an attacker-controllable source, such as the URL, and passes it to a sink that supports dynamic code execution, such as eval() or innerHTML. This enables attackers to execute malicious JavaScript, which typically allows them to hijack other users' accounts. Read more in portswigger.net

Description

• The input parameter is inserted directly into innerHTML. An attacker could execute arbitrary JS code and steal users' cookies by tricking them into clicking on a crafted link or redirection domain, triggering the XSS.

Steps to Reproduce

1. Enter to the following link: https://laby.net/search?q=%3Cdetails/open=%22onxs=s%22ontoggle=%22alert(document.domain)%22%3E
   

Affected Code

• https://laby.net/build/js/user-variable-search.1d3f1b56.js
  

Suggested Mitigation

• Use textContent instead of innerHTML to escape user-controlled input.
  Read more how to prevent XSS attacks.

LBN-01-003: DOM-based XSS in cloaks page via input parameter

Description

• The input parameter is being concatenated with the translated title, the <small> tag, and then inserted with innerHTML, allowing XSS.

Steps to Reproduce

1. Enter to the following link: https://laby.net/cloaks?input=onxs%3D%3Cimg+src%3Dx%3A+onerror%3Dalert(document.domain)%3E
   

Affected Code

• https://laby.net/build/js/textures.67b2045d.js
  

Suggested Mitigation

• Examples to escape user-controlled input but still include the trusted html:

const input="<input>", translated = "LabyMod Cloaks";
heading.textContent=input;
heading.innerHTML+=` <small>${translated}</small>`;
// or
const escapeHTML = (unsafe) => {
  return unsafe
    .replaceAll("&", "&amp;")
    .replaceAll("<", "&lt;")
    .replaceAll(">", "&gt;")
    .replaceAll('"', "&quot;")
    .replaceAll("'", "&apos;");
}; 
heading.innerHTML=`${escapeHTML(input)} <small>${translated}</small>`;

LBN-01-004: DOM-based XSS in bandanas page via input parameter

Description

• The input parameter is being concatenated with the translated title, the <small> tag, and then inserted with innerHTML, allowing XSS. The same function with innerHTML from the same file as LBN-01-003 is used here to construct the layout of this path, only the value of the getHeading function changes.

Steps to Reproduce

1. Enter to the following link: https://laby.net/bandanas?input=onxs%3D%3Cimg+src%3Dx%3A+onerror%3Dalert(document.domain)%3E
   

Affected Code

• https://laby.net/build/js/textures.67b2045d.js
  

Suggested Mitigation

• The same as LBN-01-003.

LBN-01-005: DOM-based XSS in skins page via input parameter

Description

• The input parameter is being concatenated with the translated title, the <small> tag, and then inserted with innerHTML, allowing XSS. The same function with innerHTML from the same file as LBN-01-003 is used here to construct the layout of this path, only the value of the getHeading function changes.

Steps to Reproduce

1. Enter to the following link: https://laby.net/skins?input=onxs%3D%3Cimg+src%3Dx%3A+onerror%3Dalert(document.domain)%3E
   

Affected Code

• https://laby.net/build/js/textures.67b2045d.js
  

Suggested Mitigation

• The same as LBN-01-003.

LBN-01-006: HTML Injection in @profile page via social-icon tooltip

What is HTML Injection?

HTML Injection is an attack that is similar to Cross-site Scripting (XSS). While in the XSS vulnerability the attacker can inject and execute Javascript code, the HTML injection attack only allows the injection of certain HTML tags. When an application does not properly handle user supplied data, an attacker can supply valid HTML code, typically via a parameter value, and inject their own content into the page. This attack is typically used in conjunction with some form of social engineering, as the attack is exploiting a code-based vulnerability and a user's trust. Read more in acunetix.com

Description

• The username or display name of the services linked to the account appears in the user's profile as a button with Bootstrap tooltip that is triggered, in this case, from a mouseover event and using data-html=true. By being able to manipulate Spotify's display name and inserting HTML code, attackers could use the <img> tag to display NSFW content, make a request to an external website, stealing browser and ip information. This vulnerability would be an XSS if Bootstrap 5.1.3 did not include a sanitizer or if there was a known bypass.

Steps to Reproduce

1. Change your Spotify's display name to: <img/src=//x55.netlify.app>
2. Once logged into your laby.net account, go to: https://laby.net/connect/spotify
3. Switch to off and on to refresh the cache in your profile.
   

Affected Code

• Escaped HTML entities are usually unescaped when inserted into tag attributes.
  

Suggested Mitigation

Alternatives:

1. Remove data-html=true (icon-verified will not be rendered);
2. Escape user-controlled input twice, e.g.:
   <'"> → <'">.
3. Use Bootstrap's tooltip template option.

Report Timeline

1. 1685682900 - Initial report sent.
2. 1685688000 - Vulnerabilities fixed.

Thank you for this very detailed report! Fixes are deployed just now. :)

@niklaswa
You are welcome, I hope I helped!
Retested, vulnerabilities fixed.
Do you mind if I change this gist to public?

@Slowftw No, I don't mind. Feel free to change it to public.