Security: Cross-origin code execution via unvalidated postMessage in builder-block (CWE-346)
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- react, typescript
Research direction
Start in builder-block.component.tsx around line 255 and compare its onWindowMessage handler with the validation in builder-component.component.tsx:532 and builder-content.component.tsx:126. Review builder.class.ts:1166 to understand how frame editing activates the listener. Done means builder-block messages use the trusted-host check and the reported cross-origin execution path is no longer available.
Written by the indexing model from the issue text.
Description
Hi,
I found a cross-origin code execution issue in the Builder React SDK. Two pieces chain together.
Missing origin validation on postMessage
In builder-block.component.tsx around line 255, the onWindowMessage handler processes builder.patchUpdates messages without checking the sender's origin. The adjacent components do validate:
builder-component.component.tsx:532— callsBuilder.isTrustedHostForEvent(event)before processingbuilder-content.component.tsx:126— callsBuilder.isTrustedHostForEvent(event)before processingbuilder-block.component.tsx:255— does NOT validate
An attacker who can send a postMessage to the window (via iframe or window.open) can patch the bindings property on any block. Bindings go through stringToFunction -> new Function() -> arbitrary JavaScript execution in the host page context.
Editing mode via query parameter
In builder.class.ts:1166, editing mode is toggled by checking for builder.frameEditing= in the query string. Any page can be iframed with that parameter to force editing mode, activating the unvalidated message listener.
Chain: attacker iframes victim page with ?builder.frameEditing=true, sends crafted postMessage with malicious binding, gets code execution.
Fix: Add the same Builder.isTrustedHostForEvent(event) check to builder-block.component.tsx:onWindowMessage that the other components already have.
Reported by ProScan AppSec (https://proscan.one)
- Dominant language
- TypeScript
- Stars
- 8.8k
- Forks
- 1.2k
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 16
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from BuilderIO/builder
-
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
-
Difficulty 4/5 3-5 days Newbie friendliness 68/100
-
Storybook 11 Support Open
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
Difficulty 3/5 1-2 days Newbie friendliness 76/100
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
All issues in BuilderIO/builder
Similar issues
-
calcite-components needs triage refactor
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Esri/calcite-design-system#15203 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 91/100
-
community first-timers-only good first issue hacktoberfest help wanted low hanging fruit up-for-grabs
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100