SNYK-JS-JQUERY-569619
## Overview [jquery](https://www.npmjs.com/package/jquery) is a package that makes things like HTML document traversal and manipulation, event handling, animation, and Ajax much simpler with an easy-to-use API that works across a multitude of browsers. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). `load()` fails to recognize and remove "`<script>`" HTML tags that contain a whitespace character, i.e: "`</script >`" which results in the enclosed script logic to be executed. This can lead to Cross-site Scripting attacks when an attacker has control of the enclosed script. ## PoC by Robert McLaughlin `index.html:` ```bash <html> <head> <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js"></script> </head> <body> <div id="mydiv"></div> <script> $("#mydiv").load('inject.html #himom'); </script> </body> </html> ``` `inject.html:` ```bash <div id="himom"><script>alert('Arbitrary Code Execution');</script ></div> ``` ## Remediation Upgrade `jquery` to version 1.9.1 or higher. ## References - [GitHub Additional Information](https://github.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.js#L203) - [Exploit DB](https://www.exploit-db.com/exploits/52141)
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| 0 |
Timeline
- May 19, 2020 CVE Updated
- May 19, 2020 CVE Published
References
- https://security.snyk.io/vuln/SNYK-JS-JQUERY-569619 advisory
- https://learn.snyk.io/lesson/dom-based-xss/ technical
- https://www.npmjs.com/package/jquery vendor
- https://github.com/jquery/jquery/blob/9e6393b0bcb52b15313f88141d0bd7dd54227426/src/ajax.js#L203 technical
- https://www.exploit-db.com/exploits/52141 technical
- https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.js technical