CVE-2024-53274: Habitica Reflected XSS Vulnerability

CVE-2024-53274 Overview

Habitica is an open-source habit-building program used by a large community of self-improvement users. Versions prior to 5.28.5 contain a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the register function inside home.vue. The flaw stems from an incorrect sanitization function applied to the redirectTo parameter. An attacker who crafts a malicious link and convinces a victim to click it can execute arbitrary JavaScript in the victim's browser session. Version 5.28.5 contains the patch. The CVSS 4.0 base score is 2.0, reflecting user interaction requirements and limited confidentiality, integrity, and availability impact confined to the subsequent system scope.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's authenticated Habitica session by luring the user to a crafted URL containing a malicious redirectTo parameter.

Affected Products

Habitica versions prior to 5.28.5
Affected component: website/client/src/components/static/home.vue
Affected component: website/client/src/components/auth/registerLoginReset.vue

Discovery Timeline

2024-12-12 - CVE-2024-53274 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53274

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the client-side Vue component that handles user registration on the Habitica home page. The register function reads the redirectTo query parameter and passes it to a sanitization routine that fails to neutralize dangerous payloads. The unsanitized value is then reflected back into the DOM, allowing attacker-controlled markup or JavaScript to execute within the victim's browsing context.

Because the payload runs in the authenticated origin of Habitica, an attacker can access session cookies not marked HttpOnly, invoke authenticated API endpoints, exfiltrate user data, or perform state-changing actions on behalf of the victim. Exploitation requires the victim to click a crafted link, which limits the practical severity but does not eliminate risk in phishing or social-engineering scenarios.

Root Cause

The original implementation relied on DOMPurify applied inconsistently to the redirectTo value. The fix, published in commit 946ade5da1f52a804ef2ba76d49416c43e8166bf, replaces the ad-hoc call with a dedicated sanitizeRedirect mixin imported from @/mixins/sanitizeRedirect. This centralizes URL validation so that only same-origin or allow-listed redirect targets are honored, preventing javascript: URIs and inline script payloads from being reflected.

Attack Vector

An attacker crafts a URL to a vulnerable Habitica endpoint with a malicious redirectTo parameter carrying an XSS payload. The victim clicks the link (for example, from a phishing email or forum post). The register handler processes the parameter and injects the payload into the page, where it executes with the victim's Habitica privileges.

text

// Patch: website/client/src/components/auth/registerLoginReset.vue
 import hello from 'hellojs';
 import debounce from 'lodash/debounce';
 import isEmail from 'validator/es/lib/isEmail';
-import DOMPurify from 'dompurify';
 import { MINIMUM_PASSWORD_LENGTH } from '@/../../common/script/constants';
 import { buildAppleAuthUrl } from '../../libs/auth';
-
+import sanitizeRedirect from '@/mixins/sanitizeRedirect';
 import exclamation from '@/assets/svg/exclamation.svg';
 import gryphon from '@/assets/svg/gryphon.svg';
 import habiticaIcon from '@/assets/svg/logo-horizontal.svg';
 import googleIcon from '@/assets/svg/google.svg';
 import appleIcon from '@/assets/svg/apple_black.svg';

 export default {
+  mixins: [sanitizeRedirect],
   data () {
     const data = {
       username: '',

Source: GitHub Commit 946ade5

Detection Methods for CVE-2024-53274

Indicators of Compromise

Inbound HTTP requests to Habitica registration or login routes containing a redirectTo query parameter with URL-encoded <script>, javascript:, onerror=, or onload= substrings.
Referrer logs showing external sites redirecting users to Habitica URLs with unusually long or obfuscated redirectTo values.
Client-side error reports or Content Security Policy violation logs referencing inline script execution on home.vue routes.

Detection Strategies

Deploy a web application firewall rule that inspects the redirectTo parameter for encoded script tags, protocol handlers (javascript:, data:), and event-handler attributes.
Enable Content Security Policy (CSP) reporting to capture blocked inline script executions and identify probing attempts.
Correlate authentication events with suspicious redirect parameters to identify session-abuse patterns following user clicks.

Monitoring Recommendations

Aggregate web server access logs and query them for anomalous redirectTo values across all Habitica-hosted endpoints.
Monitor outbound traffic from user browsers to attacker-controlled domains that could receive exfiltrated session data.
Track the deployed Habitica version across environments and alert when instances remain below 5.28.5.

How to Mitigate CVE-2024-53274

Immediate Actions Required

Upgrade all Habitica deployments to version 5.28.5 or later, which contains the sanitization fix.
Audit any forks or downstream distributions of Habitica for the same vulnerable pattern in home.vue and registerLoginReset.vue.
Rotate active user sessions if there is any indication that the vulnerable code path was targeted.

Patch Information

The fix is delivered in commit 946ade5da1f52a804ef2ba76d49416c43e8166bf, which removes the direct DOMPurify call and introduces the sanitizeRedirect mixin for consistent validation of redirect URLs. See the Habitica security patch commit and the GitHub Security Advisory GHSL-2024-109 for complete technical details.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Filter incoming requests at a reverse proxy or WAF to strip or reject redirectTo parameters containing script payloads or non-relative URLs.
Educate users about phishing links that impersonate Habitica URLs until patched versions are fully rolled out.

bash

# Upgrade Habitica to a patched release
git fetch --tags
git checkout v5.28.5
npm install
npm run build