Executive brief
The npm validator library is a popular Node.js package used to sanitize and validate user input to prevent security attacks. Versions before 1.1.0 contain a flaw in the XSS (cross-site scripting) filter that allows attackers to bypass protection through UI redressing techniques, potentially enabling injection of malicious scripts into web pages. This could lead to theft of user session data, credential harvesting, or defacement of the application.
Technical details
This vulnerability exists in the validator module's XSS filter implementation (CWE-79: Improper Neutralization of Input During Web Page Generation). The root cause is insufficient handling of UI redressing attack vectors in the XSS validation logic. The vulnerability requires user interaction (victim viewing a crafted web page) and network access to exploit, but no authentication is needed. An attacker can craft specially formed input containing UI redressing techniques that the validator fails to properly sanitize, allowing malicious JavaScript to be injected and executed in users' browsers. The flaw was patched in version 1.1.0 of the validator package.
Affected products
- npm validator < 1.1.0
Timeline
- 2016-04-20: disclosed: CVE assigned via oss-security mailing list
- 2013: patched: Fixed in version 1.1.0
- 2017-10-24: advisory: GitHub Advisory GHSA-552w-rqg8-gxxm published