T03 · Remote Payload Retrieval and Execution
Error
- Location
- scripts/dashboard.html:158
- Finding
- Remote JavaScript Payload Execution Through JSONP<![CDATA[ ## Vulnerability Details **File Location**: `scripts/dashboard.html`, lines 158–172 **Vulnerability Type**: Remote script retrieval and execution **Risk Level**: High ### Vulnerable Code ```javascript async function fetchStockData(code) { // 使用JSONP方式获取腾讯数据 return new Promise((resolve) => { const script = document.createElement('script'); const callbackName = 'stockCallback_' + Date.now(); window[callbackName] = function(data) { resolve(data); delete window[callbackName]; document.body.removeChild(script); }; script.src = `https://qt.gtimg.cn/q=${code}&callback=${callbackName}`; script.onerror = () => resolve(null); document.body.appendChild(script); ``` ### Technical Analysis The dashboard creates a `<script>` element whose source points to an external server and inserts it into the document. Unlike a normal data request, a remotely sourced script is executed directly in the dashboard's JavaScript context. Consequently, the effective executable payload is controlled by `qt.gtimg.cn` and can change after the Skill package has been reviewed. HTTPS protects transport integrity but does not protect against compromise of the remote service, DNS or certificate infrastructure failures, or malicious changes made by the service operator. The network access to Tencent is necessary for obtaining market quotes, but granting the quote provider arbitrary script-execution capability exceeds the minimum privilege required to retrieve quote data. ### Attack Path 1. A user opens `scripts/dashboard.html`. 2. `refreshData()` calls `fetchStockData()` for each configured ticker. 3. The function constructs a script URL hosted at `qt.gtimg.cn`. 4. The browser downloads the response and executes it as JavaScript rather than treating it as inert data. 5. If the endpoint or its delivery infrastructure returns malicious JavaScript, that code executes in the dashboard con ...[truncated 820 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove dynamic insertion of third-party `<script>` elements. 2. Retrieve quote data as inert JSON using `fetch()` from an endpoint that explicitly supports CORS. 3. If the upstream API does not provide JSON with CORS, use a small trusted local backend that fetches and parses the quote response, validates it, and returns a strict JSON schema. 4. Validate ticker codes against a restrictive pattern such as `^(sh|sz)[0-9]{6}$`. 5. Validate every returned field's type, range, and maximum length before rendering. 6. Add a restrictive Content Security Policy, for example limiting `script-src` to `'self'` and avoiding `unsafe-inline`. 7. If remote scripts are unavoidable, proxy and pin reviewed content rather than executing a mutable third-party response directly. ]]>