Executive brief
jQuery, a widely used JavaScript library for website interactivity, contains a flaw in how it processes web page elements. An attacker could use this to run unauthorized scripts in a user's browser, potentially leading to the theft of session cookies or sensitive information. This issue affects older versions of the library and can be resolved by updating to a modern version.
Technical details
A cross-site scripting (XSS) vulnerability exists in jQuery versions prior to 1.9.0. The root cause is an unanchored regular expression in the main jQuery(strInput) function used to differentiate between HTML strings and DOM selectors. In affected versions, the library identifies input as HTML if the '<' character appears anywhere in the string, whereas fixed versions require the string to explicitly start with '<'. An attacker can exploit this by providing a specially crafted string that jQuery misinterprets as executable HTML rather than a selector, leading to client-side code execution. This vulnerability is also tracked as a duplicate under CVE-2017-16011.
Affected products
- jQuery jquery < 1.9.0
- Rails jquery-rails < 2.2.0
Timeline
- 2012-06-19: disclosed: Vulnerability originally disclosed
- 2013-01-15: patched: Fixed in jQuery version 1.9.0
- 2018-01-18: advisory: NVD published CVE-2012-6708
- 2020-09-01: advisory: GitHub Advisory published
References
- https://github.com/jquery/jquery/commit/05531fc4080ae24070930d15ae0cea7ae056457d
- https://web.archive.org/web/20200227132049/http://www.securityfocus.com/bid/102792
- https://snyk.io/vuln/npm:jquery:20120206
- https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450223
- https://research.insecurelabs.org/jquery/test