CVE-2024-53273: Habitica Reflected XSS Vulnerability

CVE-2024-53273 Overview

CVE-2024-53273 is a reflected cross-site scripting (XSS) vulnerability in Habitica, an open-source habit-building program. The flaw resides in the register function within RegisterLoginReset.vue, where an incorrect sanitization routine handles the redirectTo parameter. An attacker who convinces a victim to register or log in through a specially crafted link can execute arbitrary script in the victim's browser context. Successful exploitation grants the attacker control over the victim's Habitica account. Versions prior to 5.28.5 are affected, and the maintainers released a patch in version 5.28.5. The weakness is classified as [CWE-79], improper neutralization of input during web page generation.

Critical Impact
Attackers can take over victim accounts when users authenticate through a malicious redirectTo link.

Affected Products

Habitica versions prior to 5.28.5
Habitica web client component website/client/src/components/auth/registerLoginReset.vue
Habitica web client component website/client/src/components/static/home.vue

Discovery Timeline

2024-12-12 - CVE-2024-53273 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53273

Vulnerability Analysis

The vulnerability affects the authentication flow of the Habitica Vue.js client. The register function in RegisterLoginReset.vue reads the redirectTo query parameter and passes it through a sanitization step that fails to strip dangerous payloads. Because the value is later reflected into a navigation or DOM sink, attacker-controlled script executes in the origin of the Habitica application. When the victim registers or logs in through the crafted link, the injected script runs with the victim's session, enabling account takeover through session or credential theft. The attacker only needs the victim to click the malicious URL, which qualifies this as a reflected XSS requiring user interaction.

Root Cause

The root cause is reliance on an incorrect sanitization function for the redirectTo parameter. The pre-patch code imported DOMPurify and used it in a context that did not adequately constrain the redirect target. Neither URL scheme allow-listing nor same-origin validation was enforced before the value was consumed by the client. As a result, payloads such as javascript: URIs and other unsafe values bypassed the check.

Attack Vector

Exploitation proceeds over the network with no authentication required. The attacker crafts a Habitica URL containing a malicious redirectTo value and delivers it through phishing, chat, or a compromised page. When the victim opens the link and completes registration or login, the injected payload runs in the Habitica origin. The attacker can then exfiltrate session tokens, perform actions as the victim, or change account credentials.

text

// Patch diff: website/client/src/components/auth/registerLoginReset.vue
 import hello from 'hellojs';
 import debounce from 'lodash/debounce';
 import isEmail from 'validator/es/lib/isEmail';
-import DOMPurify from 'dompurify';
 import { MINIMUM_PASSWORD_LENGTH } from '@/../../common/script/constants';
 import { buildAppleAuthUrl } from '../../libs/auth';
-
+import sanitizeRedirect from '@/mixins/sanitizeRedirect';
 import exclamation from '@/assets/svg/exclamation.svg';
 import gryphon from '@/assets/svg/gryphon.svg';
 import habiticaIcon from '@/assets/svg/logo-horizontal.svg';
 import googleIcon from '@/assets/svg/google.svg';
 import appleIcon from '@/assets/svg/apple_black.svg';

 export default {
+  mixins: [sanitizeRedirect],
   data () {
     const data = {
       username: '',

Source: Habitica commit 946ade5

The patch replaces the direct DOMPurify import with a dedicated sanitizeRedirect mixin that validates and normalizes the redirect target before it is used.

Detection Methods for CVE-2024-53273

Indicators of Compromise

Inbound requests to Habitica login, registration, or password reset endpoints containing redirectTo values with javascript:, data:, vbscript:, or HTML tag characters.
Referrer logs showing external hosts delivering users to Habitica authentication URLs with unusual redirectTo query strings.
Unexpected outbound requests from browsers immediately after Habitica login, indicating possible token exfiltration.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the redirectTo parameter on Habitica authentication routes and block non-relative or non-allow-listed values.
Correlate authentication events with subsequent account setting or email changes within a short window to surface potential takeover activity.
Review browser console errors and Content Security Policy (CSP) violation reports for the Habitica origin to identify script execution attempts.

Monitoring Recommendations

Enable CSP reporting with a strict script-src directive on the Habitica deployment and forward reports to a centralized log store.
Monitor authentication and session events for the same user across geographically distant IP addresses in short intervals.
Alert on anomalous URL patterns in HTTP access logs where the redirectTo query parameter contains encoded angle brackets or scheme identifiers.

How to Mitigate CVE-2024-53273

Immediate Actions Required

Upgrade Habitica to version 5.28.5 or later, which contains the fix in commit 946ade5da1f52a804ef2ba76d49416c43e8166bf.
Invalidate active user sessions after upgrading to force reauthentication and remove any tokens harvested through prior exploitation.
Advise users to reset passwords and review recent account activity if they followed suspicious Habitica links.

Patch Information

The fix is included in Habitica 5.28.5. The maintainers removed the direct DOMPurify usage in RegisterLoginReset.vue and home.vue and introduced a shared sanitizeRedirect mixin that validates redirect targets before use. See the Habitica security patch commit and the GitHub Security Lab advisory GHSL-2024-109 for full technical details.

Workarounds

If patching is not immediately possible, deploy WAF rules that reject requests to Habitica authentication endpoints when redirectTo contains characters outside a strict allow-list.
Enforce a restrictive Content Security Policy that blocks inline script execution and disallows untrusted script sources on the Habitica origin.
Educate users to access Habitica directly through a trusted bookmark rather than following third-party links to login or registration pages.

bash

# Example nginx rule to block dangerous redirectTo values on Habitica auth routes
location ~ ^/(register|login|reset) {
    if ($arg_redirectTo ~* "(javascript:|data:|vbscript:|<|>|%3C|%3E)") {
        return 400;
    }
    proxy_pass http://habitica_backend;
}