Report Cocalc
The web portal for projects on CoCalc allows rendering HTML tags within .rmd files without adequately sanitizing script tags and other XSS vectors. This vulnerability enables attackers to execute cross-site scripting (XSS) attacks on CoCalc users.
The rendering of .rmd files on the project pages lacks proper sanitization of XSS vectors. Although the rendered HTML content is placed in a separate iframe, it does not have the correct sandbox attributes and shares the same origin as the outer context. This setup allows attackers to access the cocalc.com cookies and the parent context through window.parent.
This vulnerability can impact CoCalc users in several ways:
Shared Projects. When a project is shared with collaborators, an attacker can upload a malicious .rmd file to the project server. If a collaborator views the rendered .rmd file, they will be exposed to the attack.
Course Setup. CoCalc allows setting up courses where .rmd files can be shared among students and teachers. These shared files can exploit the vulnerability, affecting anyone who views them.
Downloaded Files. Users who download and import a shared .rmd file from the internet, which may contain malicious attack vectors, will also be susceptible to this vulnerability.
In contrast, JupyterLab properly sanitizes all XSS vectors during the render process of Markdown files, effectively protecting users from such attacks.
A client-side XSS sanitizer should be adopted to sanitize HTML tags in .rmd files before rendering (Just like what has been implemented in server-side rendering :>)
The render of .rmd file with the following payload embedded will trigger the XSS attack.
The payload:
<img src=; onerror=alert(document.cookie)>
- Related Works
- HTML Injection
- DOM Clobbering
- Evaluation
- Discussion
- Others