| tiêu đề | onyx-dot-app Onyx Craft main commit 711a0479f1630dcce38f8f58212a63080702b753 Same-Origin Iframe Sandbox Bypass / Stored Cross-Site Scripting |
|---|
| Mô tả | Summary
Onyx Craft renders LLM-generated web applications inside an iframe served from the same origin as the main Onyx application. The iframe sandbox combines allow-scripts and allow-same-origin. Because the framed document has the parent's real origin, attacker-controlled JavaScript in a Craft preview can access the parent DOM, origin storage, and same-origin authenticated API requests as the viewer.
Affected code and root cause
At commit 711a0479f1630dcce38f8f58212a63080702b753, web/src/app/craft/components/output-panel/PreviewTab.tsx renders:
<iframe src={webappUrl} sandbox="allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation" />
backend/onyx/server/features/build/session/manager.py constructs the preview URL as:
webapp_url = f"{WEB_DOMAIN}/api/build/sessions/{session_id}/webapp"
WEB_DOMAIN is the ordinary Onyx application origin. There is no separate preview origin. backend/onyx/server/features/build/webapp_proxy.py strips Cookie, Authorization, CSRF-related and identity headers before forwarding a request to the sandbox, and strips Set-Cookie from the response. This protects the backend hop but does not isolate JavaScript after the proxied response is rendered by the victim's browser on the Onyx origin.
Proof of concept
1. Create a Craft session whose generated web application contains attacker-controlled JavaScript.
2. Make that Craft session accessible to another authorized user through the product's supported sharing/access mechanism.
3. Have that second user open the Craft preview.
4. From the preview script, access window.parent or send a request to an innocuous authenticated endpoint such as /api/me with credentials included.
5. The operation executes with the Onyx origin and the viewer's authenticated browser context.
An illustrative payload is:
<script>
fetch(window.top.location.origin + '/api/me', {credentials: 'include'})
.then(r => r.json())
.then(d => { document.body.textContent = JSON.stringify(d); });
</script>
The payload intentionally displays the response locally and does not exfiltrate data.
Impact
This is same-origin stored cross-site scripting/session riding. Malicious JavaScript in a Craft preview can act through authenticated same-origin APIs as the viewing user and interact with the parent application DOM. If an administrator views a malicious preview, administrative actions may be performed in that account context. Reading an HttpOnly session cookie is not required.
Affected version
Confirmed by source review on Onyx main commit 711a0479f1630dcce38f8f58212a63080702b753 (2026-09-19). Craft is documented as main-only at the time of reporting, so no released fixed version is known.
Vendor coordination and disclosure status
Reported privately to onyx-dot-app through GitHub Private Vulnerability Reporting on 2026-09-21. Repository advisory GHSA-grhq-88h5-2h86 is in triage, unpublished, and has no CVE assigned. The project was therefore notified before this submission. Reporter credit requested: capivara-research.
Duplicate check
The project's five public advisories and public GitHub/NVD results were reviewed. No advisory or CVE describing this Craft same-origin iframe sandbox bypass was found as of 2026-09-21.
Suggested remediation
Serve Craft previews from an origin isolated from the primary Onyx application. As an immediate mitigation, remove allow-same-origin from the iframe sandbox and apply a restrictive sandbox Content-Security-Policy to proxied untrusted content.
CWE-79: Improper Neutralization of Input During Web Page Generation (stored XSS)
CWE-1021: Improper Restriction of Rendered UI Layers or Frames
Suggested CVSS v3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N (8.7 High)
References
Private vendor report: https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86
Affected source: https://github.com/onyx-dot-app/onyx/blob/711a0479f1630dcce38f8f58212a63080702b753/web/src/app/craft/components/output-panel/PreviewTab.tsx#L83-L94
Product: https://github.com/onyx-dot-app/onyx
|
|---|
| Nguồn | ⚠️ https://github.com/onyx-dot-app/onyx/security/advisories/GHSA-grhq-88h5-2h86 |
|---|
| Người dùng | fernando viana (UID 101484) |
|---|
| Đệ trình | 21/09/2026 03:05 (cách đây 1 tháng) |
|---|
| Kiểm duyệt | 24/10/2026 13:13 (1 month later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 426102 [onyx-dot-app Onyx đến 5.0.0 PreviewTab.tsx Tập lệnh chéo trang] |
|---|
| điểm | 20 |
|---|