REDHAT-BUG-2542699: XSS
A DOM-based cross-site scripting (XSS) flaw was found in Project Quay's OAuth local callback handler (OAuthLocalHandler.tsx). When the format=json query parameter is supplied, the component reads the accesstoken from the URL fragment and assigns it to document.body.innerHTML via JSON.stringify, which does not HTML-encode angle brackets. An attacker can craft a URL containing a malicious accesstoken in the fragment that, when clicked by a Quay user, executes arbitrary JavaScript in the Quay registry origin. The format=json code path bypasses OAuth state validation and requires no authentication.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need authentication. Exploitation requires persuading a Quay user to open an attacker-crafted URL with a malicious access_token value in the URL fragment and the format=json query parameter.
Is OAuth state validation performed on the affected path?
No. The format=json callback path bypasses OAuth state validation.
What is the impact if exploitation succeeds?
The malicious token value can execute arbitrary JavaScript in the Quay registry origin. This is a DOM-based cross-site scripting issue in the OAuth local callback handler.