Executive brief
bpmn-js-properties-panel is a JavaScript library for editing BPMN diagram properties in web applications. Versions before 0.31.0 fail to sanitize user input in specially crafted diagrams, allowing attackers to inject malicious JavaScript code that executes in the context of the embedding website, potentially compromising user sessions or stealing sensitive data.
Technical details
The vulnerability is a Cross-Site Scripting (CWE-79) flaw in the bpmn-js-properties-panel library where input validation and output encoding are insufficient when processing diagram data. An attacker can craft a specially configured BPMN diagram containing JavaScript payloads that are not properly sanitized before being rendered in the page. When a victim opens or interacts with the malicious diagram in an application using the vulnerable version, the injected script executes with the privileges of that user. The vulnerability was fixed in version 0.31.0 and later.
Affected products
- bpmn-js contributors bpmn-js-properties-panel prior to 0.31.0
Timeline
- 2020-09-03: disclosed