CVE-2024-34343
📋 TL;DR
This vulnerability in Nuxt's navigateTo function allows cross-site scripting (XSS) attacks by bypassing JavaScript protocol blocking. Attackers can inject malicious JavaScript that executes in users' browsers after server-side rendering. All Nuxt applications using affected versions are vulnerable to this client-side XSS.
💻 Affected Systems
- Nuxt
📦 What is this software?
Nuxt by Nuxt
⚠️ Risk & Real-World Impact
Worst Case
Full account takeover, session hijacking, credential theft, and complete client-side compromise through malicious JavaScript execution in users' browsers.
Likely Case
Session hijacking, credential theft, and client-side data exfiltration through XSS payloads delivered via manipulated URLs.
If Mitigated
Limited impact with proper Content Security Policy (CSP) headers and input validation, though XSS may still occur in certain scenarios.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but is straightforward with publicly available techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.12.4
Vendor Advisory: https://github.com/nuxt/nuxt/security/advisories/GHSA-vf6r-87q4-2vjf
Restart Required: Yes
Instructions:
1. Update package.json to specify 'nuxt': '^3.12.4'. 2. Run 'npm update nuxt' or 'yarn upgrade nuxt'. 3. Restart the Nuxt application server. 4. Verify the update with 'npm list nuxt' or 'yarn list nuxt'.
🔧 Temporary Workarounds
No workarounds available
allThe vendor advisory states there are no known workarounds for this vulnerability
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline JavaScript execution
- Add additional input validation and sanitization for all URL parameters and user inputs
🔍 How to Verify
Check if Vulnerable:
Check package.json for Nuxt version below 3.12.4 or run 'npm list nuxt' / 'yarn list nuxt' to see installed versionCheck Version:
npm list nuxt | grep nuxt || yarn list nuxt | grep nuxtVerify Fix Applied:
Confirm Nuxt version is 3.12.4 or higher using 'npm list nuxt' or 'yarn list nuxt'📡 Detection & Monitoring
Log Indicators:
- Unusual URL patterns with javascript: protocol attempts
- Multiple failed URL parsing attempts
- Client-side error logs containing script execution errors
Network Indicators:
- HTTP requests containing javascript: protocol in parameters
- Unusual redirect patterns with encoded whitespace characters
SIEM Query:
web.url CONTAINS 'javascript:' OR web.url CONTAINS '%0A' OR web.url CONTAINS '%09'