CVE-2016-7103: jQuery-UI cross-site scripting in dialog closeText parameter

CVE-2016-7103 · Severity: low · CVSS 3.1 · Published 2017-10-24

jQuery-UI is a widely-used JavaScript library for building interactive user interfaces. When an application passes unsanitized user input to the closeText parameter of the dialog function, an attacker can inject arbitrary JavaScript code that executes in the victim's browser. This enables session hijacking, credential theft, malware distribution, or defacement of the affected web page.

Technologies: org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet), jquery-ui-rails (RubyGems). Vendors: Maven, npm, NuGet, RubyGems.

Quick answers

Is CVE-2016-7103 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2016-7103 being exploited in the wild.
How severe is CVE-2016-7103?
Low severity, with a CVSS score of 3.1, published 24 October 2017.
Which products and versions are affected?
org.webjars.npm:jquery-ui (Maven) ECOSYSTEM:introduced=0,fixed=1.12.0; jquery-ui (npm) SEMVER:introduced=0,fixed=1.12.0; jQuery.UI.Combined (NuGet) ECOSYSTEM:introduced=0,fixed=1.12.0; jquery-ui-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=6.0.0.
Is there a fix for CVE-2016-7103?
Yes. org.webjars.npm:jquery-ui (Maven): upgrade to 1.12.0 or later; jquery-ui (npm): upgrade to 1.12.0 or later; jQuery.UI.Combined (NuGet): upgrade to 1.12.0 or later; jquery-ui-rails (RubyGems): upgrade to 6.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7103 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2016-7103?
Check whether you run org.webjars.npm:jquery-ui (Maven), jquery-ui (npm), jQuery.UI.Combined (NuGet) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.webjars.npm:jquery-ui (Maven): upgrade to 1.12.0 or later
    # set org.webjars.npm:jquery-ui to 1.12.0 in your pom.xml or build.gradle
  • jquery-ui (npm): upgrade to 1.12.0 or later
    npm install jquery-ui@1.12.0
  • jQuery.UI.Combined (NuGet): upgrade to 1.12.0 or later
    dotnet add package jQuery.UI.Combined --version 1.12.0
  • jquery-ui-rails (RubyGems): upgrade to 6.0.0 or later
    bundle update jquery-ui-rails

Technical details

This is a stored/reflected cross-site scripting (XSS) vulnerability in jQuery-UI's dialog widget. The closeText parameter, which sets the text for the dialog's close button, does not properly sanitize or escape user-supplied input before rendering it in the DOM. An attacker can inject HTML and JavaScript payload (e.g., <script>alert('XSS')</script>) into the closeText parameter, which is then executed when the dialog is displayed. The vulnerability requires user interaction (opening the dialog) and the application must pass unsanitized user input to the vulnerable parameter. The fix is to upgrade to jQuery-UI 1.12.0 or later, where the parameter value is properly escaped.

Affected products

  • jQuery jQuery-UI before 1.12.0

Identifiers

  • CVE-2016-7103
  • GHSA-hpcf-8vf9-q4gj

Timeline

  • 2015-10-19: disclosed: Vulnerability reported on GitHub issue tracker
  • 2016: patched: Fixed in jQuery-UI 1.12.0
  • 2017-10-24: advisory: GHSA-hpcf-8vf9-q4gj published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.