Executive brief
jQuery-UI is a widely-used JavaScript library for building interactive user interfaces. When an application passes unsanitized user input to the closeText parameter of the dialog function, an attacker can inject arbitrary JavaScript code that executes in the victim's browser. This enables session hijacking, credential theft, malware distribution, or defacement of the affected web page.
Technical details
This is a stored/reflected cross-site scripting (XSS) vulnerability in jQuery-UI's dialog widget. The closeText parameter, which sets the text for the dialog's close button, does not properly sanitize or escape user-supplied input before rendering it in the DOM. An attacker can inject HTML and JavaScript payload (e.g., <script>alert('XSS')</script>) into the closeText parameter, which is then executed when the dialog is displayed. The vulnerability requires user interaction (opening the dialog) and the application must pass unsanitized user input to the vulnerable parameter. The fix is to upgrade to jQuery-UI 1.12.0 or later, where the parameter value is properly escaped.
Affected products
- jQuery jQuery-UI before 1.12.0
Timeline
- 2015-10-19: disclosed: Vulnerability reported on GitHub issue tracker
- 2016: patched: Fixed in jQuery-UI 1.12.0
- 2017-10-24: advisory: GHSA-hpcf-8vf9-q4gj published