CVE-2020-7741
📋 TL;DR
CVE-2020-7741 is a Cross-Site Scripting (XSS) vulnerability in hellojs library versions before 1.18.6. Attackers can inject malicious JavaScript via the oauth_redirect parameter, which gets passed to location.assign without sanitization. Any application using vulnerable hellojs versions for OAuth authentication is affected.
💻 Affected Systems
- hellojs
📦 What is this software?
Hello.js by Hello.js Project
⚠️ Risk & Real-World Impact
Worst Case
Full account takeover, session hijacking, credential theft, and complete compromise of user accounts through malicious JavaScript execution in victim's browser context.
Likely Case
Attackers steal authentication tokens, session cookies, or redirect users to phishing sites, leading to account compromise.
If Mitigated
Limited impact with proper Content Security Policy (CSP) headers and input validation in place, though vulnerability still exists.
🎯 Exploit Status
Simple XSS payload injection via URL parameter, no authentication required. Example: javascript:alert(1) in oauth_redirect parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.18.6
Vendor Advisory: https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669
Restart Required: No
Instructions:
1. Update hellojs package to version 1.18.6 or later. 2. Run npm update hellojs or yarn upgrade hellojs. 3. Test OAuth functionality after update.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject malicious oauth_redirect values containing javascript: or other dangerous protocols.
Content Security Policy
allImplement strict CSP headers to prevent execution of inline scripts and restrict script sources.
Content-Security-Policy: script-src 'self' https://trusted.cdn.com;
🧯 If You Can't Patch
- Implement WAF rules to block requests containing javascript: in oauth_redirect parameter
- Disable or replace hellojs OAuth functionality with alternative authentication library
🔍 How to Verify
Check if Vulnerable:
Check package.json or node_modules/hellojs/package.json for version number. If version < 1.18.6, vulnerable.Check Version:
npm list hellojs | grep hellojs or cat node_modules/hellojs/package.json | grep versionVerify Fix Applied:
After update, verify hellojs version is 1.18.6 or higher and test OAuth flow with malicious input to confirm rejection.📡 Detection & Monitoring
Log Indicators:
- Unusual oauth_redirect parameter values containing javascript: or data: protocols
- Failed OAuth authentication attempts with suspicious parameters
Network Indicators:
- HTTP requests with javascript: in oauth_redirect query parameter
- Redirects to unexpected domains during OAuth flow
SIEM Query:
http.uri_query:*javascript* AND http.uri_query:*oauth_redirect*🔗 References
- https://github.com/MrSwitch/hello.js/blob/3b79ec93781b3d7b9c0b56f598e060301d1f3e73/dist/hello.all.js%23L1545
- https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669
- https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546
- https://github.com/MrSwitch/hello.js/blob/3b79ec93781b3d7b9c0b56f598e060301d1f3e73/dist/hello.all.js%23L1545
- https://github.com/MrSwitch/hello.js/commit/d6f5137f30de6e0ef7048191ee6ae575fdc2f669
- https://snyk.io/vuln/SNYK-JS-HELLOJS-1014546
