U.S. CISA adds JQuery flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-11023 | Cross-Site Scripting (XSS) in jQuery DOM Manipulation (CVE-2020-11023) CVE-2020-11023 is a cross-site scripting flaw in jQuery versions 1.0.3 through before 3.5.0 in which HTML originating from untrusted sources - even after sanitization - can execute attacker-controlled script when passed to jQuery DOM manipulation methods such as .html() and .append(). It is triggered whenever a web application renders untrusted or user-supplied HTML through these APIs, and the underlying bug was patched in jQuery 3.5.0. Successful exploitation lets an attacker run JavaScript in a victim's browser in the context of the affected site (CVSS 3.1: 6.1, network vector, user interaction required, low confidentiality/integrity impact), potentially enabling session-cookie theft or content injection. Because jQuery ships with countless applications, themes, plugins, and downstream distributions - including Debian, Fedora, Drupal, Oracle, NetApp, and Tenable products - the affected population is very large and not precisely enumerated. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-01-23, confirming exploitation in the wild, and EPSS places its 30-day exploitation probability at 83.8% (100th percentile). Do: Upgrade jQuery to 3.5.0 or later everywhere it is used, including copies bundled or cached inside applications, themes, plugins, and frameworks, and apply patches or mitigations per advisories from Debian, Fedora, Drupal, Oracle, NetApp, and Tenable. Because CISA has added this flaw to the Known Exploited Vulnerabilities catalog, apply vendor mitigations or discontinue use of affected components; as an interim measure, avoid passing user-supplied or untrusted HTML to .html(), .append(), and related DOM manipulation methods. | 6.1 | 85% | KEV PoC |
| masstens of millions of websites and applications bundling affected jQuery |
Full article426 words · extracted from securityaffairs.com · click to collapse
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds JQuery vulnerability to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a JQuery persistent cross-site scripting (XSS) vulnerability, tracked as CVE-2020-11023 (CVSS score: 6.9) to its Known Exploited Vulnerabilities (KEV) catalog.
In jQuery 1.0.3 to 3.4.1, using DOM methods with untrusted HTML containing <option> elements can execute untrusted code. Fixed in jQuery 3.5.0.
“Passing HTML containing <option> elements from untrusted sources – even after sanitizing them – to one of jQuery’s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.” reads the advisory.
To mitigate this issue without upgrading, sanitize HTML with DOMPurify‘s SAFE_FOR_JQUERY option before using it in jQuery methods.
“The main change in this release is a security fix, and it’s possible you will need to change your own code to adapt. Here’s why: jQuery used a regex in its jQuery.htmlPrefilter method to ensure that all closing tags were XHTML-compliant when passed to methods. For example, this prefilter ensured that a call like jQuery(“<div class=’hot’ />”) is actually converted to jQuery(“<div class=’hot’></div>”). Recently, an issue was reported that demonstrated the regex could introduce a cross-site scripting (XSS) vulnerability.” reads the advisory.
“The HTML parser in jQuery <=3.4.1 usually did the right thing, but there were edge cases where parsing would have unintended consequences. The jQuery team agreed it was necessary to fix this in a minor release, even though some code relies on the previous behavior and may break. The jQuery.htmlPrefilter function does not use a regex in 3.5.0 and passes the string through unchanged.”
“However, to sanitize user input properly, we also recommend using dompurify with the SAFE_FOR_JQUERY option to sanitize HTML from a user. If you don’t need the old behavior, but would still like to sanitize HTML from a user, dompurify should be used without the SAFE_FOR_JQUERY option, starting in jQuery 3.5.0. For more details, please see the 3.5 Upgrade Guide.”
The vulnerability was reported by the researcher Masato Kinugawa.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by February 14, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA Known Exploited Vulnerabilities catalog)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/173388/breaking-news/u-s-cisa-adds-jquery-flaw-known-exploited-vulnerabilities-catalog.html