# Back to the (Clip)board with Microsoft Whiteboard and Excalidraw in Meta (CVE-2023-26140)

Clipboard-poisoned payloads inject javascript: links in Excalidraw and permissive iframe sandbox in Microsoft Whiteboard, enabling XSS and top-navigation redirect.

- Payout: Research
- Severity: medium
- Program: Excalidraw
- Found by (vendor credit): Eugene Lim, The MOps Team
- Write-up by: Eugene Lim
- Disclosed: 2024-02-04
- CVE: CVE-2023-26140
- Write-up quality: 7/10
- Original: https://spaceraccoon.dev/clipboard-microsoft-whiteboard-excalidraw-meta/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-clipboard-microsoft-whiteboard-excalidraw-meta
- Tags: area:web domain:web impact:ato kind:research platform:research sev:medium tech:rest technique:chained technique:js-analysis technique:source-review vuln:clickjacking vuln:xss

**Target:** Collaborative whiteboard web app (clipboard paste handler, SVG anchor href, iframe sandbox attribute)
**Root cause:** Excalidraw sets anchor href from pasted element.link without scheme validation; Microsoft Whiteboard accepts attacker-controlled iframe sandbox values including allow-top-navigation and allow-scripts.
**Steps:**
1. Open Excalidraw whiteboard, log paste events via `document.addEventListener('paste', e => console.log(e.clipboardData.getData('text/plain')))`
2. Copy a rectangle to obtain the `excalidraw/clipboard` JSON structure
3. Modify the element's `link` field to `javascript:alert(document.domain)` and place the JSON on the clipboard as text/plain
4. Paste into the whiteboard; clicking the rendered shape executes the javascript: URI
5. For Whiteboard: craft `<whiteboard-tag whiteboardcontent="<urlencoded JSON>">` with content.iframe = `{"src":"<attacker site>","sandbox":["allow-top-navigation","allow-scripts","allow-same-origin"]}` and write to clipboard as text/html
6. Victim pastes; iframe loads attacker site which calls `top.window.location.replace('https://evil.com')`
**How found:** CodeQL flagged clipboardData flowing into img.src (false positive), prompting manual review of Excalidraw sinks; found anchor href sink in renderElementToSvg, then used dynamic paste-event logging to capture real serialized clipboard format instead of reverse-engineering it statically.
**Exploitation:** Attacker hosts a page with a hijacked copy button (document.execCommand('copy') on a temp input) that silently places the poisoned clipboard payload; victim pastes into the whiteboard, triggering javascript: link click or top-navigation redirect into attacker site, potentially pivoting into Teams/desktop AppX context.
**Escalation:** Whiteboard rendered inside Microsoft Teams and Windows AppX desktop app, so client-side redirect/XSS can pivot into desktop or Teams context.
**Insight:** When static analysis of complex clipboard serialization is painful, instrument the paste event in the dev console to dump the real text/plain and text/html payload, then mutate the exact field (link, iframe sandbox) rather than hand-crafting the format.