Executive brief
The validator library for Node.js, which is used by developers to sanitize and validate user input, contains a flaw in its Cross-Site Scripting (XSS) filter. An attacker can bypass security protections by using specially crafted nested strings that the filter fails to remove. This could allow an attacker to execute malicious scripts in a user's browser, potentially leading to unauthorized actions or data theft.
Technical details
The validator library for Node.js (versions prior to 1.1.0) is vulnerable to a Cross-Site Scripting (XSS) filter bypass. The vulnerability exists because the sanitization logic fails to recursively or effectively handle nested forbidden strings. A remote attacker can exploit this by submitting input containing nested tags or forbidden keywords that, when processed once, leave behind executable malicious code. This is a network-based attack that typically requires user interaction (UI:R) to execute the resulting script in the victim's browser context. The issue was addressed in version 1.1.0.
Affected products
- Node.js validator < 1.1.0
Timeline
- 2013-12-12: disclosed: Vulnerability identified (based on CVE year)
- 2017-01-23: advisory: NVD published the CVE details