CVE-2024-53272: Habitica Reflected XSS Vulnerability

CVE-2024-53272 Overview

Habitica is an open-source habit-building program with web and mobile clients. Versions prior to 5.28.5 contain two reflected cross-site scripting (XSS) vulnerabilities in the login and social media functions within RegisterLoginReset.vue. The flaw stems from an incorrect sanitization function applied to the redirectTo parameter. An attacker can craft a malicious link that, when clicked by a victim during registration or login, executes attacker-controlled JavaScript in the victim's browser context. Successful exploitation can grant the attacker control of the victim's Habitica account. The issue is tracked as [CWE-79] and patched in version 5.28.5.

Critical Impact
Account takeover via reflected XSS triggered by a crafted redirectTo parameter during login or social media authentication flows.

Affected Products

Habitica versions prior to 5.28.5
RegisterLoginReset.vue component (login and social media functions)
Habitica web client authentication flow

Discovery Timeline

2024-12-12 - CVE CVE-2024-53272 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53272

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw located in Habitica's authentication component website/client/src/components/auth/registerLoginReset.vue. The affected code paths handle the login and social media sign-in flows and consume the redirectTo query parameter supplied by the user. The parameter is passed through a sanitization routine that fails to neutralize JavaScript payloads before the value is reflected back into the DOM or used as a navigation target.

Because the vulnerability triggers during the authentication flow, exploitation yields access to session material established at login. An attacker who delivers a crafted URL to a target can execute script in the authenticated origin and hijack the victim's Habitica account.

Root Cause

The pre-patch code imported DOMPurify and relied on it directly to filter the redirectTo value. The sanitization approach did not sufficiently restrict dangerous URL schemes or script-bearing payloads, allowing reflected injection. The fix replaces that logic with a dedicated sanitizeRedirect mixin that enforces stricter validation of the redirect target.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker crafts a Habitica URL containing a malicious redirectTo parameter and delivers it through phishing or social engineering. When the victim registers or logs in using the link, the unsanitized value is processed by the vulnerable component and the attacker's payload executes in the victim's browser session.

text

// Security patch in website/client/src/components/auth/registerLoginReset.vue
 import hello from 'hellojs';
 import debounce from 'lodash/debounce';
 import isEmail from 'validator/es/lib/isEmail';
-import DOMPurify from 'dompurify';
 import { MINIMUM_PASSWORD_LENGTH } from '@/../../common/script/constants';
 import { buildAppleAuthUrl } from '../../libs/auth';
-
+import sanitizeRedirect from '@/mixins/sanitizeRedirect';
 import exclamation from '@/assets/svg/exclamation.svg';
 import gryphon from '@/assets/svg/gryphon.svg';
 import habiticaIcon from '@/assets/svg/logo-horizontal.svg';
 import googleIcon from '@/assets/svg/google.svg';
 import appleIcon from '@/assets/svg/apple_black.svg';

 export default {
+  mixins: [sanitizeRedirect],
   data () {
     const data = {
       username: '',

Source: HabitRPG/habitica commit 946ade5

The patch removes the direct DOMPurify import and introduces the sanitizeRedirect mixin, which centralizes safe handling of redirect targets. A similar change is applied to website/client/src/components/static/home.vue.

Detection Methods for CVE-2024-53272

Indicators of Compromise

Inbound requests to Habitica login or social media authentication endpoints containing a redirectTo parameter with javascript:, data:, or encoded <script> payloads.
Referrer logs showing authentication requests originating from external, attacker-controlled domains.
Unexpected session token issuance immediately following requests carrying a suspicious redirectTo value.

Detection Strategies

Inspect web server and reverse proxy logs for authentication URLs where the redirectTo query parameter contains encoded script fragments or non-relative URLs.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline-script execution attempts within the Habitica client origin.
Review client-side error telemetry for anomalous navigation events triggered during the login flow.

Monitoring Recommendations

Alert on authentication requests whose redirectTo parameter length or character set deviates from a known allowlist of internal paths.
Monitor for account activity following login events linked to externally sourced referrers.
Track deployed Habitica versions in internal inventories to ensure instances remain on 5.28.5 or later.

How to Mitigate CVE-2024-53272

Immediate Actions Required

Upgrade all Habitica deployments to version 5.28.5 or later, which includes the sanitizeRedirect mixin fix.
Audit authentication logs for prior requests containing suspicious redirectTo values and review the associated accounts for compromise.
Rotate session cookies and prompt password resets for accounts suspected to have logged in via crafted links.

Patch Information

The fix is delivered in Habitica 5.28.5 via commit 946ade5. Technical details are documented in the GitHub Security Advisory GHSL-2024-109.

Workarounds

Enforce a strict Content Security Policy on the Habitica origin to block inline script execution and limit permitted navigation schemes.
Filter inbound traffic at a web application firewall to reject authentication requests whose redirectTo parameter contains non-relative URLs or script keywords.
Educate users to access Habitica via bookmarks rather than following redirectTo links received in email or chat.

bash

# Example WAF rule concept to drop risky redirectTo values on login endpoints
SecRule REQUEST_URI "@beginsWith /login" \
  "chain,id:1005327,phase:2,deny,status:400,msg:'Suspicious redirectTo parameter'"
  SecRule ARGS:redirectTo "@rx (?i)(javascript:|data:|<script|%3Cscript)" "t:none,t:urlDecodeUni"