CVE-2008-6681: Dojo cross-site scripting in dijit.Editor and textarea

Executive brief

Dojo is a popular JavaScript library used to build interactive web applications. A security flaw in its text editor and textarea components allows attackers to run malicious scripts in a user's browser. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technical details

A cross-site scripting (XSS) vulnerability exists in the dijit.Editor and textarea components of the Dojo Toolkit. The root cause is improper neutralization of input, specifically allowing XML entities within a TEXTAREA element to be executed as JavaScript even when sanitization is applied. A remote attacker can exploit this by injecting arbitrary web script or HTML. This vulnerability is resolved in Dojo version 1.1.0.

Affected products

• Dojo Foundation dojo < 1.1.0

Timeline

• 2009-04-09: disclosed: NVD publication date
• 2020-09-01: advisory: GitHub Advisory published

References

• https://bugs.dojotoolkit.org/ticket/2140
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49883
• https://www.npmjs.com/advisories/107
• http://trac.dojotoolkit.org/changeset/15346
• http://trac.dojotoolkit.org/ticket/2140
• http://www.dojotoolkit.org/book/dojo-1-1-release-notes