New XSS vector in ReaderMode with %READER-TITLE-NONCE%

How it was found

Summary:

Previously, script execution in ReaderMode pages was prohibited by CSP. However, three months ago, this commit partially relaxed the CSP and scripts with nonce-%READER-TITLE-NONCE% are now allowed to be executed. This relaxation of the CSP rule can be exploited for XSS attacks on ReaderMode pages.

Here, the attack vector is %READER-CREDITS% which is also included in the ReaderMode HTML template. The %READER-CREDITS% is replaced with the value of the <meta name="author"> tag in the original page, but then the HTML tags are not escaped. So, when the following meta tag is embedded in the original page and the page is displayed in ReaderMode, this Swift code replaces %READER-TITLE-NONCE% with the correct nonce value.

<meta name="author" content="Evil &lt;script nonce=%READER-TITLE-NONCE%&gt;alert(document.location);&lt;/script&gt;!--">

As a result, the malicious script will be executed on a page http://localhost:6571/reader-mode?uri={uri}&uuidkey={value}. In Brave, all readalized pages are hosted on http://localhost:6571. Therefore, through this XSS, any cross-origin pages, that has been converted to ReaderMode, can be stolen by embedding an iframe and reading out them. Also, please find that the uuidkey is included in the URL query string. By obtaining this key, the attacker can gain access to Brave's privileged pages.

Products affected:

• Brave iOS 1.31.1 and higher (including the latest Nightly)

Steps To Reproduce:

• Show https://csrf.jp/2021/brave/author_xss.php
• Push reader mode button on the address bar
• An alert dialog is shown

Supporting Material/References:

• See the screenshot of the alert dialog when the bug is reproduced.

Impact

• Any cross-origin pages, that has been converted to ReaderMode, can be stolen
• Attacker can gain access to Brave's privileged pages