Executive brief
jQuery is a widely-used JavaScript library for DOM manipulation and event handling. Versions 3.0.0-rc.1 contain a bug in attribute handling that causes the application to enter an infinite loop and crash when accessing boolean HTML attributes with mixed-case names, leading to denial of service for any web page using affected jQuery versions.
Technical details
The vulnerability is an infinite recursion flaw (CWE-674) in jQuery's attribute getter logic. When attempting to access a boolean attribute using a name containing uppercase characters (e.g., `attr('requiRed')`), the lowercasing logic fails and triggers unbounded recursion that exhausts the call stack. The attack vector is network-based; any script on a web page can trigger the condition simply by calling `.attr()` with a mixed-case attribute name on any element. No authentication is required. An attacker can exploit this to cause a denial of service by crashing the browser or application. The issue was fixed in jQuery 3.0.0.
Affected products
- jQuery jQuery 3.0.0-rc.1
Timeline
- 2016-05-29: disclosed
- 2016-05-29: patched: Fixed in jQuery 3.0.0
- 2018-01-22: advisory