CVE-2010-5312: jQuery UI cross-site scripting in Dialog title

CVE-2010-5312 · Severity: low · CVSS 3.1 · Published 2017-10-24

jQuery UI is a popular JavaScript widget library used to build interactive web components. The Dialog widget—a common tool for displaying messages and forms—fails to safely sanitize the title option, allowing an attacker to inject malicious JavaScript that runs in the context of a user's browser. This could lead to session hijacking, credential theft, or defacement of web applications using affected versions.

Technologies: org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet), jquery-ui-rails (RubyGems). Vendors: Maven, npm, NuGet, RubyGems.

Quick answers

Is CVE-2010-5312 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2010-5312 being exploited in the wild.
How severe is CVE-2010-5312?
Low severity, with a CVSS score of 3.1, published 24 October 2017.
Which products and versions are affected?
org.webjars.npm:jquery-ui (Maven) ECOSYSTEM:introduced=1.7.0,fixed=1.10.0; jquery-ui (npm) SEMVER:introduced=1.7.0,fixed=1.10.0; jQuery.UI.Combined (NuGet) ECOSYSTEM:introduced=1.7.0,fixed=1.10.0; jquery-ui-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=4.0.0.
Is there a fix for CVE-2010-5312?
Yes. org.webjars.npm:jquery-ui (Maven): upgrade to 1.10.0 or later; jquery-ui (npm): upgrade to 1.10.0 or later; jQuery.UI.Combined (NuGet): upgrade to 1.10.0 or later; jquery-ui-rails (RubyGems): upgrade to 4.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2010-5312 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2010-5312?
Check whether you run org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery-ui (Maven): upgrade to 1.10.0 or later
    # set org.webjars.npm:jquery-ui to 1.10.0 in your pom.xml or build.gradle
  • jquery-ui (npm): upgrade to 1.10.0 or later
    npm install jquery-ui@1.10.0
  • jQuery.UI.Combined (NuGet): upgrade to 1.10.0 or later
    dotnet add package jQuery.UI.Combined --version 1.10.0
  • jquery-ui-rails (RubyGems): upgrade to 4.0.0 or later
    bundle update jquery-ui-rails

Technical details

This is a reflected cross-site scripting (XSS) vulnerability in the Dialog widget's title-setting functionality (jquery.ui.dialog.js). The vulnerable component uses .html() or similar unsafe DOM methods to render the title option without proper escaping, allowing an attacker to inject arbitrary HTML and JavaScript. The attack requires user interaction (clicking a link or visiting a malicious page) but requires no authentication. An attacker can craft a malicious URL or web page that opens a Dialog with script-containing title text, resulting in arbitrary JavaScript execution in the victim's browser with access to cookies, session tokens, and page content. The vulnerability was fixed in version 1.10.0 by using .text() instead of unsafe HTML insertion methods to set the dialog title.

Affected products

  • jQuery Foundation jQuery UI 1.7.0 to 1.9.x (fixed in 1.10.0)

Identifiers

  • CVE-2010-5312
  • GHSA-wcm2-9c89-wmfm

Timeline

  • 2014-11-24: disclosed: NVD publication date
  • 2012: patched: Fixed in jQuery UI 1.10.0
  • 2017-10-24: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.