CVE-2024-50346

Vulnerability

Multiple HTML injection vulnerabilities exist in the WebFeed browser extension, allowing an attacker to inject malicious HTML into extension pages when a user views a crafted RSS feed [1]. The root cause is the unsafe use of innerHTML to display feed titles, summaries, and other data without proper sanitization [1].

Exploitation

A remote attacker can host a malicious RSS feed containing injected HTML. When a victim using WebFeed subscribes to or views this feed, the malicious HTML executes within the extension's context [1]. This can be leveraged for cross-site request forgery (CSRF) attacks, where the victim is tricked into sending HTTP requests to arbitrary sites with their credentials, or for UI spoofing to mislead the user [1]. No additional authentication is required beyond the victim installing the extension.

Impact

Successful exploitation allows the attacker to perform actions on the victim's behalf on arbitrary websites (CSRF) and to present deceptive interfaces (UI spoofing), potentially leading to data theft or further compromise [1].

Mitigation

The issue has been addressed in WebFeed version 0.9.2, which replaces innerHTML assignments with safer alternatives like innerText and applies html2txt sanitization [2]. Users should upgrade to this version; there are no known workarounds [1].