GitHub Advisoryadvisory · npm, Maven, NuGet, RubyGems
GHSA-2pqj-h3vj-pqgw Cross-Site Scripting in jquery
MEDIUM
Official page ↗
- Aliases
- CVE-2012-6708
- Ecosystem
- npm, Maven, NuGet, RubyGems
- Packages
- jquery, org.webjars.npm:jquery, jQuery, jquery-rails
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-64, CWE-79
- Reviewed
- 2020-08-31
Affected packages
• npm jquery: < 1.9.0 → fixed in 1.9.0
• Maven org.webjars.npm:jquery: < 1.9.0 → fixed in 1.9.0
• NuGet jQuery: < 1.9.0 → fixed in 1.9.0
• RubyGems jquery-rails: < 2.2.0 → fixed in 2.2.0
Description
Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution.
Proof of Concept
```
$("#log").html(
$("element[attribute='']").html()
);
```
Recommendation
Update to version 1.9.0 or later.
Related
Alias · CVE (1)
- CVE-2012-6708 jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-16011 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2012-6708 advisory
- https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d web
- https://web.archive.org/web/20200227132049/http://www.securityfocus.com/bid/102792 web
- https://snyk.io/vuln/npm:jquery:20120206 web
- https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450223 web
- https://research.insecurelabs.org/jquery/test web
- https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E web
- https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E web
- https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E web
- https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 web
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2012-6708.yml web
- https://github.com/rails/jquery-rails/blob/v2.2.0/vendor/assets/javascripts/jquery.js#L67 web
- https://github.com/rails/jquery-rails/blob/v2.1.4/vendor/assets/javascripts/jquery.js#L59 web
- https://github.com/jquery/jquery package
- https://bugs.jquery.com/ticket/9521 web
- https://bugs.jquery.com/ticket/6429 web
- https://bugs.jquery.com/ticket/12531 web
- https://bugs.jquery.com/ticket/11290 web
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00041.html web
- http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html web
- http://packetstormsecurity.com/files/161972/Linksys-EA7500-2.0.8.194281-Cross-Site-Scripting.html web