Executive brief
Bootstrap is a widely-used CSS and JavaScript framework for building responsive web interfaces. This vulnerability allows attackers to inject malicious JavaScript code via the data-target HTML attribute, which is used to specify collapse targets and other interactive components. An attacker can craft a malicious webpage or inject code into user-controlled data to execute arbitrary scripts in the context of a victim's browser, potentially stealing session cookies, credentials, or performing actions on their behalf.
Technical details
This is a cross-site scripting (XSS) vulnerability in Bootstrap's handling of the data-target attribute, a jQuery data attribute used for dynamic collapse and tab navigation. The vulnerable code fails to sanitize or escape the data-target value before using it in DOM operations, allowing an attacker to inject arbitrary HTML and JavaScript. The vulnerability affects Bootstrap 2.x (from 2.0.4 onwards), 3.x (before 3.4.0), and 4.x-beta (before 4.0.0-beta.2). Attack vector is network-based with user interaction required (victim must visit a malicious page or have untrusted data rendered in data-target). An attacker can execute arbitrary JavaScript in the victim's browser context. Patches were released in Bootstrap 3.4.0 and 4.0.0-beta.2, with fixes backported to later versions.
Affected products
- Bootstrap Bootstrap 2.0.4 to 3.3.7, 4.0.0-beta to 4.0.0-beta.1
- Bootstrap bootstrap-sass 2.0.4 to 3.3.7, 4.0.0-beta
Timeline
- 2016-06-27: disclosed: XSS in data-target attribute reported on GitHub issue #20184
- 2017-08-25: patched: Fix merged for v4 via PR #23679
- 2017-09-14: patched: Fix merged for v3 via PR #23687
- 2018-05-07: patched: Additional fix for tabs via PR #26460 in v3.4.0-dev
- 2019-01-09: advisory: CVE-2016-10735 published on NVD
- 2019-01-17: advisory: GHSA-4p24-vmcr-4gqj published