Cross-site Scripting (XSS)

Vulnerability

Overview CVE-2020-7741 is a reflected Cross-Site Scripting (XSS) vulnerability in the hellojs JavaScript library, affecting all versions before 1.18.6. The root cause lies in the function that handles OAuth redirects; it retrieves the oauth_redirect parameter from the URL and passes it directly to location.assign() without any validation or sanitization [1][2]. This means an attacker can supply a malicious value such as javascript:alert(1) in the oauth_redirect parameter, causing the browser to execute attacker-controlled JavaScript in the context of the application.

Exploitation

No authentication is required to exploit this vulnerability. An attacker only needs to craft a URL containing a malicious oauth_redirect value and trick a user into clicking it (or simply loading the URL). The hellojs code does not check whether the parameter is a valid URL or a safe scheme before assigning it to location. As a result, the attacker can inject arbitrary JavaScript payloads [1][2]. The vulnerability is triggered client-side and does not require any special network position beyond the ability to deliver the crafted link to a victim.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser within the context of the application using hellojs. This can lead to session hijacking, credential theft, defacement, or other malicious actions typically associated with XSS attacks [1][2]. The severity is considered high (CVSS score not provided by NVD, but Snyk and other vendors classify it as a critical XSS vulnerability). Prior to version 1.18.6, any application using hellojs was exposed to this risk.

Mitigation

The issue was fixed in commit d6f5137 by adding a isValidUrl() check before calling location.assign() [3]. Users should upgrade hellojs to version 1.18.6 or later. No workaround is available for earlier versions other than patching or sanitizing the oauth_redirect parameter externally before it reaches the vulnerable code [2].