Executive brief
Backbone is a popular JavaScript library that provides structure for building web applications. A vulnerability in the escape function used to sanitize data before displaying it in the DOM allows attackers to inject malicious scripts when user-supplied input is displayed on a page. An attacker who can control user input could execute arbitrary JavaScript in the context of another user's browser session, potentially stealing credentials or session data.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in Backbone's Model#escape function, which is responsible for encoding metacharacters to prevent injection attacks. The vulnerable regular expression fails to account for HTML entity encodings such as &#60; (encoded form of <), allowing these encoded entities to bypass the sanitization and be interpreted as HTML/JavaScript when written to the DOM. The vulnerability affects versions 0.3.3 through 0.4.x, and requires that an attacker can supply input to the escape function and that the output is written directly to the DOM. The fix, released in version 0.5.0, updates the regular expression to properly handle numeric and hexadecimal HTML entity encodings.
Affected products
- Backbone Backbone 0.3.3 to 0.4.x
Timeline
- 2019-02-18: disclosed
- 2016: patched: Fix released in version 0.5.0