wabac.js Reflected Cross-Site Scripting Vulnerability in 404 Error Handling

A reflected cross-site scripting vulnerability has been identified in wabac.js versions 2.23.10 and earlier. This issue arises in the 404 error handling logic, where the `requestURL` parameter is embedded directly into an inline `<script>` block without proper sanitization or escaping. As a result, an attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser. The impact of this vulnerability may be constrained by CORS policies, depending on the context in which wabac.js is utilized.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to a URL that triggers a 404 error while including a crafted `requestURL` parameter. The absence of sanitization will result in the execution of the injected JavaScript.

Remediation

Users can upgrade to wabac.js version 2.23.11 or later, where this vulnerability has been fixed.