PT-2020-19758 · Hello.Js · Hellojs

Anonymous Reporter + 1 · Published 2020-10-06 · Updated 2022-09-07 · CVE-2020-7741

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions hellojs versions prior to 1.18.6 hello.js versions prior to 1.18.6

Description The issue arises from the package getting the oauth redirect parameter from the URL and passing it to location.assign without proper checks and sanitization. This allows for the injection of XSS payloads into the oauth redirect URL parameter, such as javascript:alert(1).

Recommendations For versions prior to 1.18.6, update to version 1.18.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of the oauth redirect parameter in the affected URL until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-7741

GHSA-7JH9-6CPF-H4M7

SNYK-JS-HELLOJS-1014546

Affected Products

Hellojs

References · 7

• https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-7741 · Security Note
• https://osv.dev/vulnerability/GHSA-7jh9-6cpf-h4m7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7741 · Vendor Advisory
• https://github.com/MrSwitch/hello.js/blob/3b79ec93781b3d7b9c0b56f598e060301d1f3e73/dist/hello.all.js%23L1545 · Note
• https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546 · Note
• https://t.me/cvenotify/35829 · Telegram Post