Cross-site Scripting (XSS)

Affecting org.webjars.bower:angular artifact, versions (,1.6.7)

Do your applications use this vulnerable package? Test your applications

Overview

org.webjars.bower:angular is a bower WebJar for angular.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Browsers mutate attributes values such as &#12288;javascript:alert(1) when they are written to the DOM via innerHTML in various vendor specific ways. In Chrome (<62), this mutation removed the preceding "whitespace" resulting in a value that could end up being executed as JavaScript.

Here is an example of what could happen:

// Code goes here
var h1 = document.querySelector('h1');
h1.innerHTML = '<a href="&#x3000;javascript:alert(1)">CLICKME</a>';
var innerHTML = h1.innerHTML;
console.log(innerHTML);
h1.innerHTML = innerHTML;

The sanitizer contains a bit of code that triggers this mutation on an inert piece of DOM, before angular sanitizes it.

Note: Chrome 62 does not appear to mutate this particular string any more, instead it just leaves the "whitespace" in place. This probably means that Chrome 62 is no longer vulnerable to this specific attack vector.

Details

Remediation

Upgrade org.webjars.bower:angular to version 1.6.7 or higher.

References

CVSS Score

6.5
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    Low
  • Availability
    None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Credit
Unknown
CWE
CWE-79
Snyk ID
SNYK-JAVA-ORGWEBJARSBOWER-479407
Disclosed
17 Oct, 2017
Published
25 Dec, 2017