A reflected Cross-Site Scripting vulnerability (CWE-79) in the AdonisJS HTTP exception handler may allow a remote attacker to execute arbitrary JavaScript in a user’s browser by crafting a malicious URL that triggers an HTML error response.
Details
AdonisJS renders unhandled errors through the HTTP exception handler. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates error.message directly into an HTML response.
For missing routes, the generated exception message includes the requested URL. A crafted URL containing HTML or JavaScript event handlers can therefore be reflected into the response body without escaping.
Example payload pattern:
/not-found<img src=x onerror="fetch('/dashboard',{credentials:'include'})">
Validation error HTML rendering was also updated to escape field names and messages before joining them into the response body.
Impact
Exploitation requires a victim to open a crafted URL on an affected application that returns the default HTML error response.
If exploited, attacker-controlled JavaScript may execute in the origin of the affected application. Depending on the application and browser security controls, this may allow reading same-origin pages accessible to the victim, performing actions as the victim, or exfiltrating data.
Applications that define custom status pages for affected errors, return JSON responses, or otherwise avoid the default HTML exception renderer may not be exploitable through this path.
Patches
Users should upgrade to a patched version:
A reflected Cross-Site Scripting vulnerability (
CWE-79) in the AdonisJS HTTP exception handler may allow a remote attacker to execute arbitrary JavaScript in a user’s browser by crafting a malicious URL that triggers an HTML error response.Details
AdonisJS renders unhandled errors through the HTTP exception handler. When debug mode is disabled and no custom status page handles the error, the default HTML renderer interpolates
error.messagedirectly into an HTML response.For missing routes, the generated exception message includes the requested URL. A crafted URL containing HTML or JavaScript event handlers can therefore be reflected into the response body without escaping.
Example payload pattern:
Validation error HTML rendering was also updated to escape field names and messages before joining them into the response body.
Impact
Exploitation requires a victim to open a crafted URL on an affected application that returns the default HTML error response.
If exploited, attacker-controlled JavaScript may execute in the origin of the affected application. Depending on the application and browser security controls, this may allow reading same-origin pages accessible to the victim, performing actions as the victim, or exfiltrating data.
Applications that define custom status pages for affected errors, return JSON responses, or otherwise avoid the default HTML exception renderer may not be exploitable through this path.
Patches
Users should upgrade to a patched version: