Executive brief
Bootstrap is a popular open-source HTML and CSS framework used to build responsive web applications. A cross-site scripting (XSS) vulnerability exists in the scrollspy plugin's handling of the data-target property, allowing attackers to inject malicious scripts that execute in users' browsers. This could lead to session hijacking, credential theft, or defacement of affected web pages.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in Bootstrap 4.0.0 through 4.1.1, specifically affecting the scrollspy JavaScript plugin's processing of the data-target attribute. The plugin fails to properly sanitize user-controlled input in this attribute, allowing attackers to inject arbitrary HTML and JavaScript code. Exploitation requires user interaction (clicking or interacting with the affected scrollspy element) and network access to a page containing the vulnerable Bootstrap version. An attacker can craft a malicious data-target value that executes arbitrary JavaScript in the victim's browser context, potentially compromising the security of the web application. The vulnerability was fixed in Bootstrap 4.1.2 and patched versions are available.
Affected products
- Bootstrap Bootstrap 4.0.0 to 4.1.1
- TYPO3 TYPO3 CMS 8.0.0 to 8.7.22, 9.0.0 to 9.5.3
Timeline
- 2018-07-13: disclosed: CVE-2018-14041 published on NVD
- 2018-07-12: patched: Bootstrap 4.1.2 released with fix
- 2018-09-13: advisory: GHSA-pj7m-g53m-7638 published