Cross Site Scripting (XSS) in ssr-pages

Vulnerability

In ssr-pages versions prior to 0.1.5, a cross-site scripting (XSS) issue exists in the build(MessagePageOptions) function. The redirect.link property is not properly sanitized, allowing insertion of arbitrary HTML or JavaScript when untrusted input is provided.

Exploitation

An attacker can exploit this by supplying untrusted input to the redirect.link property. This input is then rendered in the generated HTML page without proper encoding, leading to script injection. The attacker must be able to control the argument passed to the build function.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, data theft, or defacement.

Mitigation

The issue is patched in version 0.1.5. Users should upgrade to this version or later. No workarounds are available as of publication [1].