Is CVE-2013-7453 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2013-7453 being exploited in the wild.

How severe is CVE-2013-7453?

Medium severity, with a CVSS score of 6.1, published 23 January 2017.

Which products and versions are affected?

validator (npm) SEMVER:introduced=0,fixed=1.1.0; Validator.Js Project Validator < 1.1.0.

Is there a fix for CVE-2013-7453?

Yes. validator (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2013-7453 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2013-7453?

Check whether you run Nodejs Node.Js, validator (npm) or Validator.Js Project Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2013-7453: Node.js validator XSS filter bypass via UI redressing

Q: Is there a fix for CVE-2013-7453?

Yes. validator (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2013-7453 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2013-7453?

Check whether you run Nodejs Node.Js, validator (npm) or Validator.Js Project Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2013-7453 · Severity: medium · CVSS 6.1 · Published 2017-01-23

The npm validator library is a popular Node.js package used to sanitize and validate user input to prevent security attacks. Versions before 1.1.0 contain a flaw in the XSS (cross-site scripting) filter that allows attackers to bypass protection through UI redressing techniques, potentially enabling injection of malicious scripts into web pages. This could lead to theft of user session data, credential harvesting, or defacement of the application.

Technologies: Nodejs Node.Js, validator (npm), Validator.Js Project Validator. Vendors: Nodejs, npm, Validator.Js Project.

Quick answers

Is CVE-2013-7453 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2013-7453 being exploited in the wild.
How severe is CVE-2013-7453?: Medium severity, with a CVSS score of 6.1, published 23 January 2017.
Which products and versions are affected?: validator (npm) SEMVER:introduced=0,fixed=1.1.0; Validator.Js Project Validator < 1.1.0.
Is there a fix for CVE-2013-7453?: Yes. validator (npm): upgrade to 1.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2013-7453 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2013-7453?: Check whether you run Nodejs Node.Js, validator (npm) or Validator.Js Project Validator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

validator (npm): upgrade to 1.1.0 or later
```
npm install validator@1.1.0
```

Technical details

This vulnerability exists in the validator module's XSS filter implementation (CWE-79: Improper Neutralization of Input During Web Page Generation). The root cause is insufficient handling of UI redressing attack vectors in the XSS validation logic. The vulnerability requires user interaction (victim viewing a crafted web page) and network access to exploit, but no authentication is needed. An attacker can craft specially formed input containing UI redressing techniques that the validator fails to properly sanitize, allowing malicious JavaScript to be injected and executed in users' browsers. The flaw was patched in version 1.1.0 of the validator package.

Affected products

npm validator < 1.1.0

Identifiers

CVE-2013-7453
GHSA-552w-rqg8-gxxm

Timeline

2016-04-20: disclosed: CVE assigned via oss-security mailing list
2013: patched: Fixed in version 1.1.0
2017-10-24: advisory: GitHub Advisory GHSA-552w-rqg8-gxxm published

References

http://www.openwall.com/lists/oss-security/2016/04/20/11

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.