Junglewise Threat Intelligence

CVE-2011-4969: jQuery Cross-Site Scripting in location.hash element selection

CVE-2011-4969 · Severity: info · CVSS 5.4 · Published 2022-05-14

Technologies: jQuery, org.webjars.npm:jquery (Maven), jquery-rails (RubyGems). Vendors: jQuery, Maven, RubyGems.

Executive brief

jQuery is a popular JavaScript library used to enhance interactivity on websites. Versions before 1.6.3 contain a vulnerability where malicious HTML tags injected through the URL hash fragment can be executed by the browser, allowing attackers to steal user sessions, credentials, or perform actions on behalf of the user. This affects any website using a vulnerable version of jQuery that dynamically selects page elements based on the URL.

Technical details

This is a reflected Cross-Site Scripting (XSS) vulnerability (CWE-79) in jQuery's location.hash handling for DOM element selection. The vulnerable code prioritized HTML tag parsing over ID selectors when using location.hash to select page elements, allowing an attacker to craft a malicious URL with injected HTML/script tags that would be executed in the victim's browser. The attack requires user interaction (clicking a malicious link) and network-level access (the link must be delivered to the target). Successful exploitation grants the attacker arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, malware delivery, and unauthorized actions. The fix (jQuery 1.6.3 and later, released September 2011) prioritizes #id selectors over <tag> patterns to prevent tag injection via location.hash. Patches are available for all affected package managers (npm, NuGet, RubyGems, Maven).

Affected products

  • jQuery jQuery before 1.6.3
  • jQuery jquery-rails before 1.0.16

Timeline

  • 2011-06-05: disclosed
  • 2011-09-01: patched: jQuery 1.6.3 released with fix
  • 2022-05-14: advisory: GitHub advisory GHSA-579v-mp3v-rrw5 published

References

Related threats