Junglewise Threat Intelligence

CVE-2015-6584: DataTables jQuery plugin cross-site scripting

CVE-2015-6584 · Severity: info · CVSS 5.1 · Published 2020-08-31

Vendors: Packagist, npm.

Executive brief

DataTables is a widely-used jQuery plugin that enhances HTML tables with sorting, filtering, and pagination capabilities. A cross-site scripting (XSS) vulnerability in the unit testing template files allows attackers to inject malicious scripts into web pages viewed by other users, potentially stealing session tokens, credentials, or sensitive data. The vulnerability affects versions 1.10.8 and earlier and was fixed in version 1.10.10.

Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw (CWE-79) in the DataTables unit testing template file (media/unit_testing/templates/6776.php). The root cause is improper input validation and encoding of the "scripts" GET parameter, which is directly echoed into HTML script tag attributes without sanitization. An attacker can craft a malicious URL containing XSS payloads that, when clicked by a user, executes arbitrary JavaScript in the victim's browser within the context of the affected page. The attack requires user interaction (clicking a link) and network reachability. An attacker can steal session cookies, perform actions on behalf of the user, redirect to phishing pages, or inject malware. The fix involves applying htmlentities() encoding to the parameter before output, preventing script injection. A patch was released in version 1.10.10 (released September 8, 2015).

Affected products

  • DataTables DataTables 1.10.8 and earlier, fixed in 1.10.10
  • npm datatables before 1.10.10
  • Packagist datatables/datatables 1.10.0 through 1.10.9

Timeline

  • 2015-09-09: disclosed: Advisory released by Netsparker (now Invicti)
  • 2015-09-08: patched: Fixed in version 1.10.10; commit ccf86dc applied htmlentities() encoding
  • 2020-08-31: advisory: GitHub Security Advisory GHSA-4mv4-gmmf-q382 published

References