Executive brief
The validator library for Node.js, which is used to sanitize and validate user input, contains a flaw that allows attackers to bypass its security filters. By using hex-encoded characters, an attacker can inject malicious scripts into web pages viewed by other users. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) filter bypass exists in the Node.js 'validator' package versions prior to 2.0.0. The vulnerability is caused by improper neutralization of hex-encoded characters within the input sanitization logic. A remote, unauthenticated attacker can exploit this by submitting specially crafted input containing hex-encoded strings that the filter fails to identify as malicious. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of a victim's browser session. The issue is resolved in version 2.0.0.
Affected products
- Node.js validator < 2.0.0
Timeline
- 2014-09-30: disclosed: Initial disclosure of related Node.js vulnerabilities
- 2016-04-20: advisory: CVE assigned via Openwall mailing list
- 2017-01-23: advisory: NVD publication date