F-2025-0005·xss

XSS possible via unfiltered src in img.initia.xyz proxy endpoint

Fixedtypescriptwidgetrouter-api
TL;DR

The img.initia.xyz proxy endpoint accepted unfiltered `src` parameters, allowing attacker-controlled URLs to be embedded into the trusted initia.xyz origin and used for XSS-style attacks.

Severity
MEDIUM
Impact
HIGH
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
HIGH
02Section · Description

Description

The img.initia.xyz proxy endpoint accepted a src query parameter without sufficient validation. An attacker could supply a URL that, when proxied through the trusted Initia origin, executed under that origin's CSP and trust boundary — enabling XSS-style attacks against users of the widget and the broader Initia application surface.

03Section · Recommendation

Recommendation

Validate src against an allowlist of trusted image hosts. Enforce a content-type check on the upstream response. Set a strict CSP on the proxy endpoint so even successful script injection cannot execute in-page.

Initia: Resolved. Pashov Audit Group: Resolved.

Status
Fixed
Fix commit
de9d3602dc1a
Fix date
2025-06-23
F-2025-0005