CVE-2024-30264: Insufficient Information (NVD-CWE-noinfo)
value: Typebot is an open-source chatbot builder. A reflected cross-site scripting (XSS) in the sign-in page of typebot.io prior to version 2.24.0 may allow an attacker to hijack a user's account. The sign-in page takes the `redirectPath` parameter from the URL. If a user clicks on a link where the `redirectPath` parameter has a javascript scheme, the attacker that crafted the link may be able to execute arbitrary JavaScript with the privileges  of the user. Version 2.24.0 contains a patch for this issue.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-04-04T21:15Z
Repository: https://github.com/baptisteArno/typebot.io
Language: Other
Files changed: apps/builder/package.json, apps/builder/src/features/auth/components/SignInForm.tsx, pnpm-lock.yaml
Commit date: 2024-03-25 19:11:39 +0100
Commit message: 🔒 Use sanitizeUrl on redirectPath auth param (#1389)


Diff: diff --git a/apps/builder/package.json b/apps/builder/package.json
index 683a5943..0d8a15ba 100644
--- a/apps/builder/package.json
+++ b/apps/builder/package.json
@@ -11,10 +11,11 @@
     "test:show-report": "pnpm playwright show-report src/test/reporters",
     "test:ui": "dotenv -e ./.env -e ../../.env -- pnpm playwright test --ui",
     "format:check": "prettier --check ./src"
   },
   "dependencies": {
+    "@braintree/sanitize-url": "7.0.1",
     "@chakra-ui/anatomy": "2.1.1",
     "@chakra-ui/react": "2.7.1",
     "@chakra-ui/theme-tools": "2.0.18",
     "@dnd-kit/core": "6.0.8",
     "@dnd-kit/sortable": "7.0.2",
diff --git a/apps/builder/src/features/auth/components/SignInForm.tsx b/apps/builder/src/features/auth/components/SignInForm.tsx
index c850dcad..85689f16 100644
--- a/apps/builder/src/features/auth/components/SignInForm.tsx
+++ b/apps/builder/src/features/auth/components/SignInForm.tsx
@@ -26,14 +26,16 @@ import { useRouter } from 'next/router'
 import { BuiltInProviderType } from 'next-auth/providers'
 import { useToast } from '@/hooks/useToast'
 import { TextLink } from '@/components/TextLink'
 import { SignInError } from './SignInError'
 import { useTranslate } from '@tolgee/react'
+import { sanitizeUrl } from '@braintree/sanitize-url'
 
 type Props = {
   defaultEmail?: string
 }
+
 export const SignInForm = ({
   defaultEmail,
 }: Props & HTMLChakraProps<'form'>) => {
   const { t } = useTranslate()
   const router = useRouter()
@@ -53,11 +55,12 @@ export const SignInForm = ({
   const hasNoAuthProvider =
     !isLoadingProviders && Object.keys(providers ?? {}).length === 0
 
   useEffect(() => {
     if (status === 'authenticated') {
-      router.replace(router.query.redirectPath?.toString() ?? '/typebots')
+      const redirectPath = router.query.redirectPath?.toString()
+      router.replace(redirectPath ? sanitizeUrl(redirectPath) : '/typebots')
       return
     }
     ;(async () => {
       const providers = await getProviders()
       setProviders(providers ?? undefined)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e9727073..c0195c2d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -27,10 +27,13 @@ importers:
         specifier: 1.11.3
         version: 1.11.3
 
   apps/builder:
     dependencies:
+      '@braintree/sanitize-url':
+        specifier: 7.0.1
+        version: 7.0.1
       '@chakra-ui/anatomy':
         specifier: 2.1.1
         version: 2.1.1
       '@chakra-ui/react':
         specifier: 2.7.1
@@ -3332,10 +3335,14 @@ packages:
 
   /@bcoe/v8-coverage@0.2.3:
     resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==}
     dev: true
 
+  /@braintree/sanitize-url@7.0.1:
+    resolution: {integrity: sha512-URg8UM6lfC9ZYqFipItRSxYJdgpU5d2Z4KnjsJ+rj6tgAmGme7E+PQNCiud8g0HDaZKMovu2qjfa0f5Ge0Vlsg==}
+    dev: false
+
   /@chakra-ui/accordion@2.2.0(@chakra-ui/system@2.5.8)(framer-motion@10.12.20)(react@18.2.0):
     resolution: {integrity: sha512-2IK1iLzTZ22u8GKPPPn65mqJdZidn4AvkgAbv17ISdKA07VHJ8jSd4QF1T5iCXjKfZ0XaXozmhP4kDhjwF2IbQ==}
     peerDependencies:
       '@chakra-ui/system': '>=2.0.0'
       framer-motion: '>=4.0.0'

Vulnerable code:       router.replace(router.query.redirectPath?.toString() ?? '/typebots')
Fixed code:     "@braintree/sanitize-url": "7.0.1",
import { sanitizeUrl } from '@braintree/sanitize-url'

      const redirectPath = router.query.redirectPath?.toString()
      router.replace(redirectPath ? sanitizeUrl(redirectPath) : '/typebots')
      '@braintree/sanitize-url':
        specifier: 7.0.1
        version: 7.0.1
  /@braintree/sanitize-url@7.0.1:
    resolution: {integrity: sha512-URg8UM6lfC9ZYqFipItRSxYJdgpU5d2Z4KnjsJ+rj6tgAmGme7E+PQNCiud8g0HDaZKMovu2qjfa0f5Ge0Vlsg==}
    dev: false