Executive brief
Mapbox.js is a JavaScript library that integrates mapping functionality and sharing controls into web applications. A vulnerability allows attackers to inject malicious scripts through the TileJSON name field when users have control over map configuration, which execute when the share control is clicked. This can lead to account compromise, session hijacking, or data theft from affected users.
Technical details
This is a cross-site scripting (CWE-79) vulnerability in the Mapbox.js library affecting versions 1.x before 1.6.6 and 2.x before 2.2.4. The vulnerability exists in the L.mapbox.map and L.mapbox.shareControl components, which fail to properly sanitize the name value from TileJSON content. An attacker can inject script content into the TileJSON name field if an application allows user control over map data sources. The malicious payload executes in the browser context of the page using Mapbox.js after a user clicks the share control. User interaction (clicking the share control) is required to trigger exploitation. Patches are available in versions 1.6.6 and 2.2.4 or later.
Affected products
- Mapbox mapbox.js 1.x before 1.6.6 and 2.x before 2.2.4
- Mapbox mapbox-rails 1.x before 1.6.6 and 2.x before 2.2.4
Timeline
- 2017-07-17: disclosed: Vulnerability disclosed on NVD
- 2018-11-09: advisory: GHSA advisory published