Hyundai Navigation App HTML Injection Vulnerability

A vulnerability allowing HTML injection has been identified in the Hyundai Navigation App, specifically in the version STD5W.EUR.HMC.230516.afa908d. The issue arises in the profile name field, where an attacker can inject HTML payloads that are subsequently rendered within the application. While the injection is possible, the payload length is restricted to 14 characters, which limits the potential for cross-site scripting (XSS) exploitation.

Impact

Exploitation of this vulnerability allows for HTML injection, with the possibility of cross-site scripting (XSS) under certain conditions.

Reproduction

To reproduce this vulnerability, navigate to the 'Settings' menu and select 'Profile'. Click on the profile name to edit it, and replace the existing name with an HTML payload, such as a header tag. The injected HTML will be rendered on the profile page. Alternatively, injecting a script tag will make the user name invisible, indicating that script tags are also executed. However, due to the 14-character limit, practical exploitation for XSS would require finding a way to bypass this restriction.