Executive brief
bootbox is a popular JavaScript library used to create modal dialog boxes in web applications. The library fails to sanitize user input passed to its dialog functions, allowing attackers to inject malicious HTML and JavaScript code that executes in the context of the user's browser. This can lead to theft of session cookies, phishing attacks, or defacement of the web application.
Technical details
The vulnerability is a Stored or Reflected Cross-Site Scripting (XSS) flaw in bootbox's dialog rendering functions (CWE-79). All versions of bootbox through 5.5.2 do not properly sanitize user-supplied input before injecting it into the DOM via dialog title, message, or button content parameters. An attacker can craft a payload containing script tags or event handlers (e.g., onclick, onload) that will execute when the dialog is displayed to the victim. No network authentication is required; the attack vector depends on how the application uses bootbox. A patch or updated guidance was not evident in the available advisory data.
Affected products
- bootbox bootbox all versions through 5.5.2
Timeline
- 2019-05-30: disclosed