[Duplicate] DOM XSS in Charting Service's URL Parameter Enables Phishing
A DOM-based XSS vulnerability in the widgetScriptUrl parameter of a charting service allows execution of arbitrary JavaScript, enabling phishing attacks to capture user credentials and potentially take over accounts.
Summary
A DOM-based Cross-site Scripting (XSS) vulnerability was discovered in a charting service's GET parameter, widgetScriptUrl. This flaw allows an attacker to inject and execute arbitrary JavaScript code in the context of the affected domain. By exploiting this vulnerability, an attacker can create a phishing page that mimics the legitimate login interface, capturing user credentials and potentially leading to account takeover.
Affected Component
The vulnerability resides in the widgetScriptUrl parameter of the charting service, which fails to properly sanitize user input before rendering it in the DOM.
Root Cause
The root cause of this vulnerability is the improper handling of user-supplied input in the widgetScriptUrl parameter. The application directly incorporates this input into the DOM without adequate validation or escaping, allowing an attacker to inject malicious scripts. The absence of security headers like Content-Security-Policy and X-Frame-Options further exacerbates the issue, as it permits the execution of injected scripts without restriction.