Executive brief
Mapbox.js is a widely-used JavaScript library for embedding interactive maps in web applications. When loading map tile metadata from untrusted sources, the library failed to sanitize the attribution field, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to session hijacking, credential theft, or other client-side attacks if a website loads map data from an attacker-controlled server.
Technical details
This is a cross-site scripting (XSS) vulnerability (CWE-79) affecting mapbox.js versions 1.x before 1.6.5 and 2.x before 2.1.7. The vulnerability exists in the L.mapbox.map and L.mapbox.tileLayer functions when they load TileJSON metadata from non-Mapbox sources. An attacker controlling a TileJSON endpoint can inject arbitrary HTML and JavaScript into the "attribution" field, which is then rendered without proper sanitization on the webpage. The attack requires a website to load untrusted TileJSON content from an attacker-controlled URL. Patches are available in version 1.6.5 (1.x branch) and 2.1.7 (2.x branch).
Affected products
- Mapbox mapbox.js 1.x prior to 1.6.5, 2.x prior to 2.1.7
- Mapbox mapbox-rails 1.x prior to 1.6.5, 2.x prior to 2.1.7
Timeline
- 2017-07-17: disclosed: CVE-2017-1000042 published on NVD
- 2018-11-09: advisory: GitHub Security Advisory GHSA-qr28-7j6p-9hmv published