XSS on Brave Today through custom RSS feed

How it was found

Summary:

Two months ago, the custom RSS feed feature was introduced to Brave Today on Brave iOS.

This feature allows to add any RSS feed to Brave Today, and the registered feed entries are shown in a tab with a hyperlink to the original article URL. Then, Brave iOS doesn't restrict the URL scheme of the original article link, which can cause XSS weakness through javascript: URL.

Here is a demonstration RSS feed of this attack. https://csrf.jp/brave/rss.php

This RSS feed contains javascript:alert(document.domain) in an entry tag like this.

<entry>
  <title>XSS</title>
  <link rel="alternate" type="text/html" href="javascript:alert(document.domain)" />
  <content type="html"><![CDATA[<img src="https://csrf.jp/test.png">]]></content>
</entry>

When user taps the entry on Brave Today, an alert dialog is shown on http://localhost:65XX.

Products affected:

• Brave iOS current Nightly build

Steps To Reproduce:

• Open "Settings"
• Tap "Brave Today" in Settings menu
• Tap "Add Source"
• Type "https://csrf.jp/brave/rss.php" and tap "Search"
• RSS feed, that name is PoC, is found, then tap "Add"
• Enable PoC feed
• Close the Settings menu and open a new tab
• Enable Brave Today, then you can find an article entry that name is "XSS"
• Tap the article, then an alert dialog is shown

Supporting Material/References:

• See attached movie file for the demonstration

Impact

As written in summary, XSS is possible on http://localhost:65XX. Note that http://localhost:65XX should be considered as a privileged domain that hosts Brave's internal features such as reader-view, error-pages and so on.