LockerProject Locker Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in LockerProject Locker versions 0.0.0, 0.0.1, and 0.1.0. The issue arises in the 'authIsAwesome' function within 'Ops/registry.js', where the 'id' parameter is directly inserted into the error response without proper sanitization. This flaw allows attackers to execute arbitrary JavaScript in the context of the user's browser. The vulnerability can be exploited remotely, and a public proof-of-concept is available.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can execute JavaScript in the context of the victim's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the '/auth/:id' endpoint, replacing ':id' with a crafted payload that includes JavaScript, such as an SVG image tag with an 'onload' event. The server response will reflect the payload, demonstrating the cross-site scripting vulnerability.