Executive brief
morris.js is a popular JavaScript library used to generate interactive graphs and charts on web pages. The library fails to properly escape text in hover-over labels, allowing attackers who can control label content to inject malicious JavaScript that executes in users' browsers when they view the graph. This could be exploited to steal user data, perform unauthorized actions, or spread malware.
Technical details
The vulnerability is a reflected/stored cross-site scripting (XSS) flaw in the hover label rendering component of morris.js. The vulnerability exists because label text is concatenated into the DOM without HTML entity encoding or escaping, allowing arbitrary script injection. An attacker who can control the data used to generate chart labels (e.g., through user input or a compromised data source) can inject JavaScript that executes client-side whenever the graph is displayed. A patch was submitted to the project in 2014 but has not been published to npm; users must install from the GitHub repository directly to obtain the fix.
Affected products
- morrisjs morris.js 0.0.0 through 0.5.x
Timeline
- 2018-11-09: disclosed: GHSA advisory published
- 2014-10-15: patched: Fix merged to GitHub repository (PR #464), but not published to npm