Junglewise Threat Intelligence

CVE-2018-14040: Bootstrap Cross-Site Scripting in collapse data-parent attribute

CVE-2018-14040 · Severity: low · CVSS 3 · Published 2022-05-13

Technologies: Bootstrap.

Executive brief

Bootstrap, a widely used web framework for designing responsive websites, is vulnerable to a security flaw that could allow attackers to execute malicious scripts in a user's browser. This occurs when the framework improperly handles certain data attributes used for collapsing page elements, tooltips, or scroll navigation. If exploited, an attacker could potentially steal user session information or perform unauthorized actions on behalf of a user visiting a compromised site.

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in Bootstrap's JavaScript plugins, specifically affecting the 'collapse', 'tooltip', and 'scrollspy' components. The root cause is insufficient sanitization of input provided to data attributes such as 'data-parent', which are processed by jQuery selectors. An attacker can provide a specially crafted string (e.g., an img tag with an onerror attribute) that executes arbitrary JavaScript when the component is initialized or triggered. This vulnerability requires user interaction (viewing a page with the malicious attribute) and affects versions 2.3.0 through 3.3.7 and 4.0.0 through 4.1.1. The issue is resolved in versions 3.4.0 and 4.1.2.

Affected products

  • Bootstrap Bootstrap >= 2.3.0, < 3.4.0; >= 4.0.0, < 4.1.2

Timeline

  • 2018-04-30: other: Issue opened for v4.1.2 release planning
  • 2018-05-29: disclosed: Vulnerability reported via GitHub issue
  • 2018-07-12: patched: Bootstrap 4.1.2 released
  • 2018-07-13: advisory: NVD published CVE-2018-14040

References