CVE-2019-18350

Vulnerability

Ant Design Pro version 4.0.0 contains a reflected cross-site scripting (XSS) vulnerability in the authorization component. The redirect GET parameter in the /user/login endpoint is not sanitized, allowing an attacker to inject a malicious javascript: URI. When a victim visits a crafted URL such as https://preview.pro.ant.design/user/login?redirect=javascript:alert(1);//, the injected JavaScript executes after the login action completes [1].

Exploitation

An attacker can exploit this vulnerability by tricking a victim into clicking a specially crafted link that includes a malicious redirect parameter. No authentication or special network position is required; the victim simply needs to be logged into the application or to complete the login process after clicking the link. The attacker's payload is reflected in the page and executed in the context of the victim's session [1].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript code in the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information, depending on the attacker's payload. The attack is limited to the scope of the victim's session and the actions available to the logged-in user [1].

Mitigation

The vulnerability was fixed in Ant Design Pro pull request #5461, which restricts redirects to the self-origin site only. Users should update to a patched version (at least the commit included in that pull request) or apply the fix manually. No known workaround is available for version 4.0.0 without applying the patch [1].