Cross-Site Scripting in jquery
Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution. ## Proof of Concept ``` $("#log").html( $("element[attribute='<img src=\"x\" onerror=\"alert(1)\" />']").html() ); ``` ## Recommendation Update to version 1.9.0 or later.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-6708US | medium6.1 | Exploit | ||
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerab… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.htmlWEB
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.htmlWEB
- http://packetstormsecurity.com/files/161972/Linksys-EA7500-2.0.8.194281-Cross-Site-Scripting.htmlWEB
- https://bugs.jquery.com/ticket/11290WEB
- https://bugs.jquery.com/ticket/12531WEB
- https://bugs.jquery.com/ticket/6429WEB
- https://bugs.jquery.com/ticket/9521WEB
- https://github.com/jquery/jqueryPACKAGE
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan