Executive brief
Select2 is a JavaScript library widely used to enhance dropdown selection fields in web applications. When displaying remotely-loaded data using HTML templates, the library fails to properly sanitize user-controlled input, allowing attackers to inject malicious JavaScript code. This can lead to session hijacking, credential theft, or redirection to fraudulent pages.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability in Select2's HTML template rendering when handling Ajax remote data loading. The vulnerable component fails to neutralize HTML/JavaScript special characters in remotely-retrieved data before inserting it into the DOM. The attack vector requires network access and user interaction (opening the Select2 dropdown), with no authentication required. An attacker who controls the remote data source or performs a man-in-the-middle attack can inject arbitrary JavaScript that executes in the victim's browser context. The vulnerability affects Select2 through version 4.0.5; it was fixed in 4.0.6.
Affected products
- Select2 JS Select2 through 4.0.5
Timeline
- 2016-09-15: disclosed: Vulnerability reported via GitHub issue
- 2019-03-27: patched: Fix released in Select2 4.0.6
- 2022-05-14: advisory: GHSA published