Executive brief
YUI is a JavaScript library widely used for web application development. The library contains a vulnerability in its Flash-based utilities (uploader.swf and io.swf) that allows attackers to inject malicious scripts into web pages through specially crafted URLs. This could compromise user sessions, steal data, or enable unauthorized actions on behalf of affected users.
Technical details
YUI versions prior to 3.10.3 contain cross-site scripting (CWE-79) vulnerabilities in the uploader.swf and io.swf Flash components, which fail to properly sanitize URL parameters before using them in script execution. An attacker can exploit this by crafting a malicious URL containing JavaScript code that gets executed in the context of a victim's browser when the affected SWF files are loaded. The vulnerability requires network access and user interaction (visiting a malicious link or page). YUI has published patched versions (3.10.3 and later) and recommends either removing self-hosted copies of these files if unused, switching to Yahoo! CDN-hosted versions, or applying the provided patches.
Affected products
- Yahoo YUI < 3.10.3
Timeline
- 2013-05-15: disclosed: YUI vulnerability advisory published
- 2013: patched: YUI 3.10.3 released with fix
- 2020-09-01: advisory: GHSA-mj87-8xf8-fp4w published