CISA Adds Five-Year-Old jQuery XSS Flaw to Exploited Vulnerabilities List
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-11358 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. NVD description · AI analysis pending | 6.1 | 87% |
| — | ||
| CVE-2020-11023 +1 in the same advisory: …11022 | Cross-Site Scripting (XSS) in jQuery DOM Manipulation (CVE-2020-11023) CVE-2020-11023 is a cross-site scripting flaw in jQuery versions 1.0.3 through before 3.5.0 in which HTML originating from untrusted sources - even after sanitization - can execute attacker-controlled script when passed to jQuery DOM manipulation methods such as .html() and .append(). It is triggered whenever a web application renders untrusted or user-supplied HTML through these APIs, and the underlying bug was patched in jQuery 3.5.0. Successful exploitation lets an attacker run JavaScript in a victim's browser in the context of the affected site (CVSS 3.1: 6.1, network vector, user interaction required, low confidentiality/integrity impact), potentially enabling session-cookie theft or content injection. Because jQuery ships with countless applications, themes, plugins, and downstream distributions - including Debian, Fedora, Drupal, Oracle, NetApp, and Tenable products - the affected population is very large and not precisely enumerated. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-01-23, confirming exploitation in the wild, and EPSS places its 30-day exploitation probability at 83.8% (100th percentile). Do: Upgrade jQuery to 3.5.0 or later everywhere it is used, including copies bundled or cached inside applications, themes, plugins, and frameworks, and apply patches or mitigations per advisories from Debian, Fedora, Drupal, Oracle, NetApp, and Tenable. Because CISA has added this flaw to the Known Exploited Vulnerabilities catalog, apply vendor mitigations or discontinue use of affected components; as an interim measure, avoid passing user-supplied or untrusted HTML to .html(), .append(), and related DOM manipulation methods. | 6.1 | 85% | KEV PoC |
| masstens of millions of websites and applications bundling affected jQuery |
Full article338 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJan 24, 2025Vulnerability / JavaScript
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday placed a now-patched security flaw impacting the popular jQuery JavaScript library to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.
The medium-severity vulnerability is CVE-2020-11023 (CVSS score: 6.1/6.9), a nearly five-year-old cross-site scripting (XSS) bug that could be exploited to achieve arbitrary code execution.
"Passing HTML containing <option> elements from untrusted sources - even after sanitizing them - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code," according to a GitHub advisory released for the flaw.
The problem was addressed in jQuery version 3.5.0 released in April 2020. A workaround for CVE-2020-11023 involves using DOMPurify with the SAFE_FOR_JQUERY flag set to sanitize the HTML string before passing it to a jQuery method.
As is typically the case, the advisory from CISA is lean on details about the specific nature of exploitation and the identity of threat actors weaponizing the shortcoming. Nor are there any recent public reports related to attacks that leverage the flaw in question.
That said, there are reports that vulnerability has been exploited by threat actors like APT1 (aka Brown Fox and Comment Panda) and APT27 (aka Brown Worm and Emissary Panda), per reports from Health-ISAC and Tenable.
Dutch security firm EclecticIQ also revealed in February 2024 that the command-and-control (C2) addresses associated with a malicious campaign exploiting security flaws in Ivanti appliances ran a version of JQuery that was susceptible to at least one of the three flaws, CVE-2020-11023, CVE-2020-11022, and CVE-2019-11358.
Pursuant to Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies are recommended to remediate the identified flaw by February 13, 2025, to secure their networks against active threats.
(The story was updated after publication to include references to reports highlighting exploitation of CVE-2020-11023.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/01/cisa-adds-five-year-old-jquery-xss-flaw.html