Attack Chain

1. Attacker authenticates to the target Novel platform with a legitimate account.
2. Attacker navigates to the book detail page and identifies the comment submission module.
3. Attacker submits a comment containing a malicious XSS payload (e.g., <svg onload=...>).
4. The application stores the unencoded malicious payload in the 'book_comment' database table.
5. A victim user navigates to the affected book detail or comment list page.
6. The victim's browser fetches the comment list via the '/api/book/comment/list' endpoint.
7. The front-end client stores the malicious content into 'window.localStorage' using the key 'book_comment_{bookId}'.
8. The Vue 3 application renders the stored content directly into the DOM via 'v-html', triggering the execution of the injected script in the victim's browser session.

Impact

Successful exploitation leads to unauthorized code execution within the victim's browser context. This allows attackers to potentially steal session cookies, perform actions on behalf of the victim, or tamper with the rendered content of the page.

Recommendation

1. Upgrade Xxyopen Novel to a patched version once available from the vendor; currently, version 3.5.0 is the only confirmed affected version.
2. Implement strict output encoding and sanitization for all user-contributed content before rendering, specifically within Vue 3 components that utilize the 'v-html' directive.
3. Review and secure the API endpoints handling comment retrieval to ensure consistent server-side input validation and output encoding.
4. Inspect application logs for anomalous requests to the '/api/book/comment/list' endpoint containing common XSS vectors or suspicious HTML tags.