Executive brief
cmmn-js-properties-panel is a JavaScript library used to manage properties in CMMN (Case Management Model and Notation) diagrams. Versions before 0.8.0 fail to properly sanitize user input in diagram configurations, allowing attackers to inject malicious JavaScript code that executes in the context of websites embedding this library, potentially leading to session hijacking, data theft, or unauthorized actions on behalf of users.
Technical details
This is a Cross-Site Scripting (CWE-79) vulnerability in cmmn-js-properties-panel prior to version 0.8.0. The root cause is insufficient input sanitization when processing specially configured diagrams. An attacker can craft a malicious diagram that, when processed by the vulnerable library, injects arbitrary JavaScript into the embedding website. The attack requires crafting a malicious diagram file or configuration, but does not require authentication or special network access beyond the ability to supply input to the library. A fix is available in version 0.8.0 and later.
Affected products
- <UNKNOWN> cmmn-js-properties-panel <0.8.0
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fixed in version 0.8.0