Junglewise Threat Intelligence

CVE-2017-1000006: Plotly plotly.js Cross Site Scripting in SVG rendering

CVE-2017-1000006 · Severity: low · CVSS 3 · Published 2017-10-24

Vendors: npm.

Executive brief

Plotly.js is a popular open-source JavaScript library used for creating interactive charts and data visualizations. A security flaw in versions prior to 1.16.0 allows an attacker to execute malicious scripts in a user's browser if the user views a specially crafted plot. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Technical details

A cross-site scripting (XSS) vulnerability exists in plotly.js versions prior to 1.16.0. The issue stems from improper neutralization of user-controllable input during the generation of SVG-based plots. An attacker can exploit this by creating a malicious plot that, when rendered by the library, executes arbitrary JavaScript in the context of the victim's browser session. This is a client-side attack requiring the victim to view the malicious content (User Interaction: Required). The vulnerability was addressed in version 1.16.0 by improving input sanitization.

Affected products

  • Plotly plotly.js < 1.16.0

Timeline

  • 2016-08-08: advisory: Original vendor security advisory released
  • 2017-07-17: disclosed: NVD published CVE-2017-1000006
  • 2017-10-24: advisory: GitHub Advisory published

References

Related threats