Executive brief
pym.js is a JavaScript library developed by NPR used to embed responsive iframes on web pages. A CSRF vulnerability in versions 0.4.2 through 1.3.1 allows attackers to execute arbitrary JavaScript code if they can trick users into visiting a malicious page or gain JavaScript access to pages containing pym.js embeds. This could result in data theft, account compromise, or malware injection on affected websites.
Technical details
pym.js contains a cross-site request forgery (CSRF) vulnerability in the _onNavigateToMessage function (line 573 of pym.js) that fails to properly validate or sanitize URLs before processing navigation requests. The vulnerability is exploitable when an attacker gains JavaScript execution context on a page with pym.js embeds, or when a user visits an attacker-crafted page that interacts with pym.js. An attacker can leverage this to execute arbitrary JavaScript code with the privileges of the page containing the pym.js embed. The vulnerability affects versions 0.4.2 through 1.3.1 and was fixed in version 1.3.2 by sanitizing URLs in the navigation handler.
Affected products
- NPR Visuals Team pym.js 0.4.2 to 1.3.1
Timeline
- 2018-03-13: disclosed
- 2018-02-15: patched: Fix released in version 1.3.2