In February 2024, a critical security flaw was discovered in the very popular tabatkins/railroad-diagrams project — a tool used to generate railroad diagrams for parsing visualizations. This bug, identified as CVE-2024-26467, puts web servers and users at risk through a classic DOM-based cross-site scripting (XSS) attack.

If you use this library in any of your web tools — especially if you provide the generator.html page to the public — read on to see how this exploit works, view code snippets that explain the danger, and learn how to secure your site right away.

What Is CVE-2024-26467?

This vulnerability is a DOM-based cross-site scripting issue in generator.html in tabatkins/railroad-diagrams before commit ea9a123.

How does XSS happen here?

The flaw occurs because untrusted values from the URL are injected directly into the DOM without proper sanitization. If an attacker can cause someone to visit a maliciously crafted URL containing JavaScript in specific parts of the address, the script will run in the context of the vulnerable site.

Suppose inside generator.html, there's a pattern like this

// Example (not actual prod code but illustrative)
const params = new URLSearchParams(window.location.search);
const userInput = params.get("input");
document.getElementById("output").innerHTML = userInput;

If userInput comes from the URL (?input=...), and it goes straight into .innerHTML, any code inside will be executed.

The attacker's payload

https://vulnerable.site/generator.html?input=<img src=x onerror=alert(1)>

This renders an img tag with onerror=alert(1), triggering a popup.

`

https://example.com/generator.html?input=

On loading the page, their browser executes the alert('XSS') code.

3. An attacker could replace alert('XSS') with more dangerous JavaScript to steal credentials, plant malware, or impersonate users.

Open the vulnerable page and try appending this to the URL

?input=<img src=x onerror=alert('VULNERABLE!')>

If you see a popup or any script run, the site is at risk.

How Was It Patched?

The offending commit ea9a123 sanitizes any input placed into the DOM. For example:

function safeHTML(str) {
  return str.replace(/[&<>"']/g, function (c) {
    return {
      '&': '&amp;',
      '<': '&lt;',
      '>': '&gt;',
      '"': '&quot;',
      "'": '&#39;'
    }[c];
  });
}
// Usage:
const userInput = params.get("input");
document.getElementById("output").innerHTML = safeHTML(userInput);

Never render unsanitized input inside .innerHTML. Use text nodes or sanitize everything first.

Update to the latest commit:

- Visit: https://github.com/tabatkins/railroad-diagrams

Search for .innerHTML= or document.write().

- If you *must* inject HTML, be sure to sanitize all inputs. Consider libraries like DOMPurify.

References

- Official GitHub advisory *(if available)*
- CVE-2024-26467 at NVD
- Patched commit ea9a123

TL;DR

- CVE-2024-26467 is an XSS bug in tabatkins/railroad-diagrams (generator.html) before ea9a123.

If you run a public instance of this generator or embed it anywhere, patch now!

Stay safe. Always sanitize user data. If you have questions, report issues here.


*This post was written for developers, security engineers, and site owners using American English and plain language for quick remediation.*

Timeline

Published on: 02/26/2024 16:27:59 UTC
Last modified on: 10/31/2024 15:35:29 UTC