| summary |
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation.
In the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal:
`<script id="spec" type="application/json">${JSON.stringify(spec)}</script>`
The JSON.stringify() function does not escape HTML characters like < or >. Therefore, if an attacker provides a string containing </script><script>..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block.
Proof of Concept (PoC)
1. Create an API router with **orpc** and configure the OpenAPI plugin.
2. In the API specification, inject a malicious payload into a field like **description**:
```
{
info: {
title: "My API",
version: "1.0.0",
description: "</script><script>alert('XSS executed on ' + document.domain)</script>"
}
}
```
3. Generate and serve the documentation HTML.
4. When a developer or user navigates to the API documentation URL, the browser parses the HTML, breaks out of the JSON block, and immediately executes the **alert()** payload.
Impact
If an application generates its OpenAPI specifications dynamically based on user-controlled inputs (or if a rogue developer modifies the spec), it leads to Stored XSS. When an administrator or developer views the API docs, the script executes in their browser, potentially leading to session hijacking or unauthorized API calls on their behalf.
Remediation
Do not use raw **JSON.stringify()** to embed data directly into HTML templates. Instead, safely serialize the JSON by escaping HTML-sensitive characters (like **<** and **>**) or use a secure HTML serialization library (such as **serialize-javascript** or **devalue**) before embedding it into the **<script>** tag.
Disclosure & Credits
If this report is helpful, I kindly request that you publish this as a formal GitHub Security Advisory and assign me credit for the discovery. Thank you for maintaining this project! |