Kortix-AI Suna DOM-Based XSS in /auth Endpoint

Vulnerability Overview A DOM-Based Cross-Site Scripting (XSS) vulnerability was discovered in Kortix-AI Suna on the and pages. The application incorrectly trusts URL parameters ( ) and passes them to and . An attacker can construct a malicious link that, when opened by an authenticated user, executes arbitrary JavaScript code within their browser context. This could lead to session hijacking, credential theft, internal network pivoting, and unauthorized actions. Impact Scope Session Hijacking: An attacker can steal the victim's session token or authentication cookie, thereby gaining full access to their account, files, and data. Arbitrary Actions: The script can use the victim's active session to make API requests, create, modify, or delete items, or perform any action authorized by the victim. Credential Theft: The script can render a fake login form within the context of the legitimate site to capture user credentials. Internal Network Pivoting: If the victim is located on an internal network, the XSS can serve as a springboard to attack other internal systems from the victim's browser. Remediation To fix this vulnerability, the application should validate and sanitize the variable before using it for redirection. Below are several approaches: Method 1 This method allows only absolute URL paths like and prevents open redirects such as . Method 2 This method allows redirection URLs with and schemes while also preventing open redirects. It is functionally equivalent to Method 1. 1. Validate that the redirect path stays within the same origin and uses a secure scheme: Use the constructor to resolve the path relative to the current origin and check the origin and protocol. This validation correctly handles: Relative paths like (resolved to ) Absolute paths within the same origin like Blocking cross-origin and open redirects like and Blocking dangerous schemes like , , , etc. 2. Apply validation before any navigation: If passes validation, it can be used safely; otherwise, fall back to a default safe path like . Sensitive Cookies Should Be Set as HttpOnly Additionally, to mitigate the impact of future XSS risks, it is recommended to mark sensitive cookies related to session identification as . This may require further adjustments to the client-side code. Currently, the has set to . POC Code Exploit Code Impact Successful exploitation of this vulnerability has a high impact: Session Hijacking: An attacker can steal the victim's session token or authentication cookie, thereby gaining full access to their account, files, and data. Arbitrary Actions: The script can use the victim's active session to make API requests, create, modify, or delete items, or perform any action authorized by the victim. Credential Theft: The script can render a fake login form within the context of the legitimate site to capture user credentials. Internal Network Pivoting: If the victim is located on an internal network, the XSS can serve as a springboard to attack other internal systems from the victim's browser. Remediation Advice To fix this vulnerability, the application should validate and sanitize the variable before using it for redirection. Below are several approaches: Method 1 This method allows only absolute URL paths like and prevents open redirects such as . Method 2 This method allows redirection URLs with and schemes while also preventing open redirects. It is functionally equivalent to Method 1. 1. Validate that the redirect path stays within the same origin and uses a secure scheme: Use the constructor to resolve the path relative to the current origin and check the origin and protocol. This validation correctly handles: Relative paths like (resolved to ) Absolute paths within the same origin like Blocking cross-origin and open redirects like and Blocking dangerous schemes like , , , etc. 2. Apply validation before any navigation: If passes validation, it can be used safely; otherwise, fall back to a default safe path like . Sensitive Cookies Should Be Set as HttpOnly Additionally, to mitigate the impact of future XSS risks, it is recommended to mark sensitive cookies related to session identification as . This may require further adjustments to the client-side code. Currently, the has set to .

Goal Reached Thanks to every supporter — we hit 100%!

Kortix-AI Suna DOM-Based XSS in /auth Endpoint

More from this source